loginportal247016gujnhchc14g5u0qs247016fhmkaaxayzb9hoxa[.]safetyconsultant[.]cl

The domain loginportal247016gujnhchc14g5u0qs247016fhmkaaxayzb9hoxa.safetyconsultant.cl was registered on February 21, 2026 and is currently taken offline. The site presented the page title "Rackspace Webmail: Hosted Email for Business," indicating a credential phishing campaign aimed at harvesting Rackspace email credentials. DNS resolution points to IP address 192.185.139.103, which is located in the United States and belongs to AS19871 Network Solutions, LLC. The hosting IP has been flagged by 22 of 93 security vendors on VirusTotal, demonstrating moderate detection confidence across multiple scanners. The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that at least one external sinkhole or filtering platform has responded to the threat.

SSL inspection shows the site used an R12 certificate, but no further certificate details are available. No additional intelligence such as OTX tags, Safe Browsing status, or registrar information was provided. The combination of a targeted page title, confirmed IP location, multiple vendor detections, and blocklist presence strongly suggests an operational credential phishing infrastructure.

Defenders should continue to monitor the associated IP address for any resurgence, ensure that inbound traffic to the host is blocked at perimeter controls, and update endpoint URL filtering policies to include the full domain string. Incident response teams should also look for related login‑portal subdomains that share the same lexical pattern, as the long, random subdomain may be part of an automated domain‑generation algorithm. Because the domain is offline, active takedown is not required at this time, but continued vigilance is advised to prevent re‑use of the same infrastructure.