correo-contraloria-gob-ec[.]weebly[.]com

This domain, correo-contraloria-gob-ec.weebly.com, is flagged for brand impersonation targeting Microsoft under the guise of an Outlook login portal. Analysis indicates the site was designed to harvest user credentials, as evidenced by the page title 'LONGOUTLOOKEC,' which mimics legitimate Outlook logout or login pages. The infrastructure is hosted on a platform-based service, a common tactic to evade initial detection while leveraging free SSL certificates to appear legitimate. Infrastructure analysis reveals the domain was registered through a corporate registrar on March 29, 2006, though the phishing content likely represents recent malicious repurposing. It resolves to the IP address 74.115.51.9, associated with a US-based hosting provider, and is currently blocked by at least one security blocklist. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, indicating moderate but consistent detection across threat intelligence sources. The SSL certificate is issued by a widely trusted certificate authority, further complicating user discernment of the site's illegitimacy. The domain is currently offline, suggesting either takedown by the hosting provider or voluntary removal by the threat actor. However, residual risk remains due to the domain's historical registration and potential for reactivation. Users who interacted with the site should assume credential exposure and initiate password resets on associated accounts. Organizations are advised to monitor for related indicators, including the IP 74.115.51.9 and the registrar's historical domain portfolio, to preemptively block similar threats.