es-portal-incidenciasweb[.]com

Analysis of es-portal-incidenciasweb.com shows a newly registered domain created on February 21, 2026 through NiceNIC International Group Co., Limited. The site serves a page titled "Cooperativa Ahorho y Crédito de Barranquitas - ¡Nuestro centro eres Tú!" and is built on a typical WordPress stack with MySQL, PHP, and Nginx, while HSTS is enabled. DNS resolution points to 104.21.70.83, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is fronted by Cloudflare nameservers (drew.ns.cloudflare.com and lilith.ns.cloudflare.com) and presents a valid SSL certificate issued by Google Trust Services under the WE1 profile, indicating encrypted HTTPS traffic.

HTTP requests return a 302 redirect, a pattern often used to mask malicious landing pages. Security telemetry flags the domain on one blocklist and it is actively listed by PhishDestroy as a phishing threat. Gridinsoft assigns a trust score of zero out of one hundred, and VirusTotal reports three detections out of ninety‑three scanning engines, reinforcing the suspicious nature.

While the exact content of the site has not been captured, the combination of recent registration, low trust score, blocklist presence, redirect behavior, and vendor detections suggests a high‑risk phishing operation targeting users of the named cooperative. Defenders should block the domain at network perimeters, monitor DNS queries for the associated Cloudflare IP range, and add it to endpoint allow‑list exclusions. Continuous re‑scanning is advised to capture any evolving payloads or credential‑harvesting forms that may appear.