# PhishDestroy domain threat record: estancialatradicion.com.ar Content language: English Canonical HTML report: https://phishdestroy.io/domain/estancialatradicion.com.ar/ Machine-readable companion: https://phishdestroy.io/domain/estancialatradicion.com.ar/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-07 20:15:11 UTC - Last availability or vendor check: 2026-10-22 10:27:58 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 18/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 149.50.142.221 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 301 - Registration date in stored WHOIS data: 2008-04-13 22:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a07d81-1e45-703d-82f0-0f14cdb02a2e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/estancialatradicion.com.ar - Certificate Transparency search: https://crt.sh/?q=%25.estancialatradicion.com.ar - Web Archive lookup: https://web.archive.org/web/*/https://estancialatradicion.com.ar/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview estancialatradicion.com.ar is an Argentine domain that PhishDestroy classifies as an impersonation phishing page built to pass itself off as a trusted service and harvest what visitors type into it. We first flagged it on 2026-09-07. As of 2026-10-19 the site was still alive and its content resolved through a redirect, so the domain remains a live risk for anyone who reaches it through a link. How the scam works Impersonation pages copy the look of a legitimate login, payment or account screen. They rely on links sent through email, messaging apps or ads. A victim who enters a username, password, card number or personal details hands them straight to the operator, who can then take over accounts or commit fraud. The redirect behaviour fits this pattern, because visitors can be routed onward to wherever the lure currently lives. The page title, in Spanish, reads that the site is unavailable at the moment and asks the visitor to try again later, which differs from the impersonation content we classified. Evidence Eighteen of 89 engines on VirusTotal flagged the domain as of 2026-09-15. The vendors include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, CyRadar and Chong Lua Dao, a spread of independent commercial and community sources. Google Safe Browsing lists it under SOCIAL_ENGINEERING, which is the category browsers use to warn users about deceptive pages. The domain also appears in five AlienVault OTX threat pulses, which shows other researchers have tracked it as well. Infrastructure The domain was registered on 2008-04-14, roughly eighteen years before it turned up on our blocklist. This is not a throwaway domain bought for a quick campaign. A long-registered name tends to carry more trust with filters and visitors than a fresh one. The site is hosted in Argentina at 149.50.142.221 on the Dattatec.com network, and that local hosting matches the .com.ar name. What to do If you entered a password on this site, change it immediately along with any account that reuses it, and turn on two-factor authentication. If you submitted card or banking details, contact your bank to block the card and dispute unfamiliar charges. Treat any follow-up messages that reference your visit as further phishing. Defenders should block the domain and its IP at the proxy and DNS layer, search mail and chat logs for links to it, and reset credentials for any users who clicked through. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a07d81-1e45-703d-82f0-0f14cdb02a2e/ VirusTotal report: https://www.virustotal.com/gui/domain/estancialatradicion.com.ar Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=estancialatradicion.com.ar Archived copy: https://web.archive.org/web/20260907201725/https://estancialatradicion.com.ar/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:47:55 UTC ## Stored page captures - Primary capture: https://i.ibb.co/mFhk7qj9/a66329d29b8f.png Captured: 2026-09-07 20:15:11 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a07d81-1e45-703d-82f0-0f14cdb02a2e.png Captured: 2026-09-07 20:15:11 UTC Source report: https://urlscan.io/result/01a07d81-1e45-703d-82f0-0f14cdb02a2e/ - URLQuery: https://screenshots.phishdestroy.io/uq/9d10bbe0-9c86-4113-a715-24272c9f30da.png Captured: 2026-09-07 20:31:39 UTC Source report: https://urlquery.net/report/9d10bbe0-9c86-4113-a715-24272c9f30da SHA-256: c97bdef3eb39f28641d5597365ea1534c63d8aabbcd52b60edbe82fee237b99f - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5b801e8b-4436-4288-a3c8-15fcfa683820.png Captured: 2026-09-07 20:54:16 UTC Source report: https://radar.cloudflare.com/scan/5b801e8b-4436-4288-a3c8-15fcfa683820 SHA-256: abe030d8f827962fa1c447f6de1a2f090ad1dcbe45f3a2838c43db60e082e1a4 - URLScan ยท 2026-09-07: https://screenshots.phishdestroy.io/us/01a07d7d-2eeb-7530-9a0a-a60ff9b1cdd9.png Captured: 2026-09-07 20:09:18 UTC Source report: https://urlscan.io/result/01a07d7d-2eeb-7530-9a0a-a60ff9b1cdd9/ SHA-256: fe926b06e4112de487ef05873460d66a9d0207cf4702b34a95da1375fcf1cf03 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:28:52Z", "uuid": "01a07d81-1e45-703d-82f0-0f14cdb02a2e", "scanned_at": "2026-09-07T20:13:36Z", "final_url": "https://estancialatradicion.com.ar/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://estancialatradicion.com.ar/", "from": "http://estancialatradicion.com.ar/", "status": 307 } ], "ip": "149.50.142.221", "ptr": "vps-4280200-x.dattaweb.com", "ips": [ "149.50.142.221" ], "asns": [ "27823" ], "countries": [ "AR" ], "doc_hash": "04f8a718686f6c2536b66b5ccff14dd1092a5aaa9f9d46d1224bf6751418a290", "tls": { "san": [ "estancialatradicion.com.ar", "www.estancialatradicion.com.ar" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "estancialatradicion.com.ar", "protocol": "TLS 1.3", "valid_to": "2026-11-15T01:42:01Z", "valid_from": "2026-08-17T01:42:02Z" }, "domain_age_days": 1398, "apex_age_days": 1398, "tls_age_days": 21, "tls_valid_days": 89, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 83, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:58:07Z", "uuid": "5b801e8b-4436-4288-a3c8-15fcfa683820", "scanned_at": "2026-09-07T20:54:16Z", "final_url": "https://estancialatradicion.com.ar/", "status": 200, "history": [ { "url": "https://estancialatradicion.com.ar/", "status": 200 } ], "dom_hash": "8dbf55f6c67635a14245a20820871c9561f3c7c5c065d574845cde43f21de453", "doc_hash": "04f8a718686f6c2536b66b5ccff14dd1092a5aaa9f9d46d1224bf6751418a290", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "estancialatradicion.com.ar", "type": "A", "value": "149.50.142.221" } ], "dnssec_valid": false, "ip": "149.50.142.221", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } } } ```