carrefour-soporteacceso[.]com

The domain carrefour-soporteacceso.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently listed as offline. Automated analysis shows the site was built on a standard WordPress stack, with MySQL, PHP, Nginx and HTTP Strict Transport Security (HSTS) enabled. The domain resolves to the Cloudflare address 188.114.96.3, which is associated with AS13335 Cloudflare, Inc. and is geolocated to the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS configuration despite the malicious intent.

Security tooling reports mixed detection: three of ninety‑three VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has actively blocked the domain, and the Gridinsoft trust score is 0 out of 100, reflecting a high confidence of malicious behavior. The page title retrieved from the live snapshot reads "Cooperativa Ahorro y Crédito de Barranquitas - ¡Nuestro centro eres Tú!", which suggests the site attempts to impersonate a financial cooperative in Puerto Rico, although the content has not been publicly disclosed. The threat is classified as generic phishing with an elevated risk rating.

At present, no further indicators such as specific phishing kits, credential‑harvesting forms, or payloads have been identified, leaving the exact attack vector uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the domain or related subdomains, and add the IP address 188.114.96.3 to network‑wide deny lists. Given the low trust score and existing blocklist entries, any outbound connections to this host should be considered hostile. Organizations targeted by the Cooperativa Ahorro y Crédito de Barranquitas brand should be warned of potential credential‑stealing attempts and instructed to verify communications through official channels.