grupopalacios[.]com[.]mx

This domain, grupopalacios.com.mx, is confirmed as a high-risk phishing site specifically designed to harvest Microsoft Outlook credentials through a fake Outlook Web App login interface. Analysis indicates the threat type is credential theft via brand impersonation, targeting users of enterprise email services with a realistic but fraudulent authentication portal. The infrastructure demonstrates deliberate targeting of corporate or institutional users, a common tactic in business email compromise (BEC) campaigns. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification. The domain resolves to IP address 162.240.79.223, hosted on AS46606 (Unified Layer) in the United States. It was registered on December 19, 2022, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abuse reports. The site employed a Let's Encrypt SSL certificate (serial YR2), providing a false sense of security to victims. Detection metrics include 20 out of 95 security vendors flagging the domain on VirusTotal, with Google Safe Browsing and one additional security blocklist listing it as phishing. The page title, Outlook Web App, directly matches the impersonated service, confirming the targeted deception. Mitigation requires immediate action from both users and security teams. Organizations should block the domain and associated IP (162.240.79.223) at the perimeter, and monitor for any attempted access from internal networks. Users who may have entered credentials should reset passwords immediately and enable multi-factor authentication on all accounts. Security teams are advised to review logs for connections to the domain or IP, particularly from endpoints with access to sensitive corporate resources. Given the domain's registration date and hosting provider, additional related infrastructure may exist; proactive hunting for similar patterns (e.g., recently registered domains with Let's Encrypt certificates resolving to the same ASN) is recommended. The site's current offline status does not eliminate risk, as phishing infrastructure is often reactivated or repurposed.