encontrar-id[.]us

This domain, encontrar-id.us, operates as a credential-harvesting phishing portal designed to mimic legitimate login pages. Analysis indicates the site presents fraudulent authentication forms to trick users into submitting usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is optimized for rapid deployment and evasion, with a focus on impersonating corporate or financial services portals to maximize credential theft success rates. Infrastructure analysis reveals the domain was registered on June 28, 2026, through Dynadot Inc, a registrar frequently leveraged for short-lived phishing campaigns. As of the latest scan, 6 out of 95 security vendors on VirusTotal have flagged encontrar-id.us as malicious, with detections primarily categorized under phishing and fraudulent login schemes. The domain resolves to the IP address 162.144.180.56, which has been associated with multiple transient phishing hosts in recent months. SSL certificate data shows a Let's Encrypt certificate, a common tactic to lend superficial legitimacy to malicious sites while avoiding cost barriers. Users who have visited encontrar-id.us or entered credentials on the site should immediately revoke any submitted login details from all associated accounts. Password resets should be performed from a separate, trusted device to prevent session hijacking. Network-level blocking of the domain and its resolving IP (162.144.180.56) is recommended for enterprise environments. Security teams should monitor for unauthorized access attempts using the compromised credentials, particularly within 24-48 hours of exposure, as phishing actors typically exploit stolen logins rapidly.