grupocaceres[.]mx

This domain, grupocaceres.mx, is identified as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the site mimics legitimate login pages, likely targeting corporate or financial service users to capture usernames, passwords, and session tokens. The threat leverages social engineering tactics, as confirmed by Google Safe Browsing’s SOCIAL_ENGINEERING classification, to trick victims into submitting sensitive information under false pretenses. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 11 out of 95 security vendors on VirusTotal, appears on 2 independent blocklists, and is referenced in 3 AlienVault OTX threat intelligence pulses. It was registered on June 15, 2026, through NEUBOX Internet SA de CV, a registrar frequently associated with malicious domains. The domain resolves to the IP address 161.35.124.162 and uses a Let’s Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Current status shows the domain has been taken offline, though residual risk remains for users who interacted with it prior to deactivation. Users who visited grupocaceres.mx or entered credentials on the site should immediately revoke any active sessions tied to the account, reset passwords using a secure device, and enable multi-factor authentication where available. Monitor linked accounts for unauthorized transactions or access attempts, particularly financial or email services. If corporate credentials were exposed, report the incident to internal security teams for further investigation. The domain’s creation date (June 15, 2026) suggests it was operational for a limited period, but all interactions during its active phase should be treated as compromised. Network administrators are advised to block the domain and its resolving IP (161.35.124.162) at the perimeter to prevent further exposure.