contact[.]botticelliri[.]com

This domain, contact.botticelliri.com, operates as a high-risk phishing infrastructure specifically designed to impersonate Microsoft login portals. The page title, 'Iniciar sesión en tu cuenta Microsoft,' directly mimics Microsoft’s authentication interface, targeting Spanish-speaking users to harvest credentials. Analysis indicates the domain functions as a credential theft mechanism, likely intended to compromise corporate or personal accounts by presenting a fraudulent but visually convincing Microsoft sign-in page. The inclusion of jQuery and Google Hosted Libraries suggests an attempt to replicate legitimate Microsoft authentication flows, increasing the likelihood of successful deception. Evidence confirms the domain’s malicious nature through multiple technical indicators. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. The domain was registered through Automattic Inc. on January 24, 2004, though its current use for phishing suggests potential compromise or repurposing of legacy infrastructure. It resolves to the IP address 67.43.12.85 and employs a Let’s Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. The trust score from Gridinsoft is 0/100, further corroborating its classification as a high-risk threat. Users who visited contact.botticelliri.com should assume their credentials may have been compromised. Immediate steps include resetting passwords for any accounts accessed through the site, enabling multi-factor authentication where available, and reviewing account activity for unauthorized access. Organizations should block the domain and its resolving IP (67.43.12.85) at the network level to prevent further exposure. If financial or sensitive data was entered, affected parties should monitor for signs of identity theft or fraudulent transactions. Given the domain’s current offline status, users should remain vigilant for similar phishing attempts using comparable infrastructure or impersonation tactics.