serviciotecnico[.]com[.]uy

serviciotecnico.com.uy is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting WhatsApp. The site presents a page title “Servicio Técnico Reparación de celulares, arreglo de pantallas, venta de accesorios”, which does not reference the targeted brand but the underlying threat is confirmed by intelligence correlating the domain with WhatsApp impersonation.

Infrastructure analysis shows the domain resolves to the IPv4 address 192.254.185.69, hosted in the United States and associated with Autonomous System 46606 (Unified Layer). The registration appears to be handled by HGBLOCK-9, matching the same ASN. Authoritative name servers are ns6325.hostgator.com and ns6326.hostgator.com. The web server presents a valid Let’s Encrypt certificate (R12) and returns HTTP status 200 on request. Gridinsoft assigns a trust score of 0 out of 100, indicating no confidence in the host.

Reputation services flag the domain extensively: VirusTotal reports 14 out of 95 security vendors have flagged the host as malicious. The domain is listed on two public phishing blocklists, PhishDestroy and PhishingDB, and has been referenced in 17 AlienVault OTX threat pulses. The overall risk rating is high and the campaign remains active.

Defenders should add 192.254.185.69 and the domain serviciotecnico.com.uy to deny‑list controls at the network perimeter and DNS resolvers. Continuous monitoring of the associated name servers and ASN for new host records is advised. Given the low trust score and multiple detections, any traffic attempting to reach the domain should be blocked, and endpoints should be instructed to quarantine related URLs.