portal-descuentoparati[.]com

This domain, portal-descuentoparati.com, operates as a fraudulent Movistar bill payment portal designed to harvest login credentials and financial details from unsuspecting users. The site displays a page titled 'Movistar Portal de Recaudos,' impersonating the legitimate telecommunications provider to trick victims into entering sensitive account information. Analysis indicates the threat is elevated due to the domain's active use in credential theft campaigns targeting Spanish-speaking users. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 1, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu and currently resolves to the IP address 20.63.74.201, hosted on Microsoft Corporation's AS8075 infrastructure in Canada. Security vendors have flagged the domain on VirusTotal, with 16 out of 95 engines detecting it as malicious. Additionally, the domain appears on two security blocklists, PhishDestroy and PhishingDB, and lacks a valid SSL certificate, further exposing users to interception risks. Users who visited portal-descuentoparati.com should immediately take corrective actions to mitigate potential compromise. First, reset any credentials entered on the site, particularly those linked to Movistar accounts or financial services. Monitor associated accounts for unauthorized transactions or suspicious activity. If payment details were submitted, contact the relevant financial institution to report potential fraud and request card replacement if necessary. Finally, scan the device used to access the site for malware, as phishing pages may distribute additional payloads.