piedrasdecolon[.]com[.]ar

The domain piedrasdecolon.com.ar is currently active and exhibits characteristics consistent with a generic phishing operation targeting individuals seeking vacation rentals. Analysis indicates this is not a legitimate booking platform but rather a fraudulent site designed to harvest personal and financial information under the guise of offering cabins in Colón, Entre Ríos. The site impersonates a local rental business, leveraging a plausible domain name and localized content to deceive potential victims. Infrastructure analysis reveals the domain is flagged by 7 of 95 security vendors on VirusTotal, a notably elevated detection rate for a site purporting to be a small business. The domain resolves to the IP address 167.250.5.47, which has been associated with other suspicious activities. The SSL certificate is issued by Let's Encrypt (R12), a common choice among threat actors due to its free and automated issuance process. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The page title, 'Alquiler de Cabañas y bungalows en Colon Entre Rios - Cabañas Piedras de Colon,' aligns with the deception, using localized terminology to enhance credibility. As of the latest verification, piedrasdecolon.com.ar remains active and continues to present a high risk to users. Individuals encountering this domain should avoid interacting with it, particularly entering any personal or payment details. Organizations are advised to update web filtering rules to block access to 167.250.5.47 and the domain itself. Users who may have engaged with the site should monitor financial accounts for unauthorized activity and consider resetting credentials for any services where similar login information may have been reused. Security teams should treat this domain as part of a broader phishing campaign and correlate its infrastructure with other known malicious indicators.