bancoprovinciapersonas[.]rafaelaveronezi[.]com[.]br

This domain, bancoprovinciapersonas.rafaelaveronezi.com.br, was observed hosting a site whose HTML title reads “Banco Provincia”, directly referencing the Banco de la Provincia de Buenos Aires brand. The domain was created on 28 March 2019 and resolves to the IP address 199.167.147.66, which belongs to AS29802 HIVELOCITY, Inc. and is geolocated in the United States. No TLS certificate was presented during connection attempts, indicating that the site operates without encryption. The authoritative name servers are ns1.barcaweb.com.br and ns2.barcaweb.com.br, both associated with the same hosting provider.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the host. VirusTotal analysis shows that 23 of 93 security scanners flagged the domain as malicious, and the site is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. The current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content. Evidence confirms that the domain is being used for brand impersonation targeting customers of the Argentine bank.

However, the exact phishing kit, credential‑harvesting page structure, and any associated command‑and‑control infrastructure remain unverified because the site is not reachable for further inspection. Defenders should continue to block the domain at perimeter filters, update any URL‑allow lists to include the host as prohibited, and monitor the hosting provider’s IP range for re‑use. Additional threat‑intel feeds should be consulted for potential redeployment of the same infrastructure under a different domain, and any future DNS queries for the listed nameservers should be logged for anomaly detection.