agrosabor[.]ec

agrosabor.ec was registered on 2025-01-08 and is currently hosted on a Hetzner server in Germany (AS24940). The domain resolves to 167.235.182.68 and uses the name servers ns17.hostingcolor.com, ns18.hostingcolor.com, and ns19.hostingcolor.com. The site presents a page titled “Agrosabor S.A.” and serves content over HTTPS with a Let’s Encrypt certificate. Technical fingerprints show an Apache HTTP server running PHP, with front‑end libraries including Bootstrap, jQuery, Modernizr, and Google Maps integration. The domain appears on one security blocklist and has been flagged by PhishDestroy. VirusTotal records 15 of 95 scanned security vendors marking the site as malicious. Independent trust scoring services assign a Gridinsoft score of 0/100 and a Scamadviser score of 1/100, indicating extremely low credibility. The MX record points to agrosabor.ec itself, which is consistent with a minimal email setup often used by fraudulent operators. Analysis classifies the site as a cryptocurrency‑focused brand‑impersonation campaign targeting the brand “base”. The page mimics legitimate branding while directing visitors toward illicit cryptocurrency transactions. The combination of a recent registration date, low trust scores, and the presence of a known blocklist entry suggests an active high‑risk operation. Publicly available information does not reveal the exact content of the fraudulent pages or the payment mechanisms employed, leaving the full scope of the scam uncertain. Defenders should block the domain at network perimeters, update email filters to reject messages referencing agrosabor.ec, and monitor DNS queries for the associated IP address and name servers. Continuous re‑scanning with multi‑engine services is advised to capture any changes in the site's behavior. Organizations using the “base” brand should issue user warnings and enforce strict verification of any cryptocurrency requests originating from this domain.