ibercajaa[.]suitaxmx[.]com[.]mx

Analysis indicates that the domain ibercajaa.suitaxmx.com.mx was registered on June 5, 2025 through Wingu Networks S.A de C.V. and resolves to the IPv4 address 65.181.113.95, which is advertised as belonging to AS209341 WHG Hosting Services Ltd in Germany. The host serves a TLS certificate issued to pisosparagimnasios.com, a clear mismatch with the domain name, suggesting the certificate was likely reused or purchased for unrelated content. Google Safe Browsing classifies the site as a social engineering threat, and the page title returned from the HTTP response is “Home Banking”, consistent with the reported scam type of Social Media Phishing targeting the Santander brand.

VirusTotal records show that 16 of 95 security vendors have flagged the domain, reinforcing the malicious assessment. The domain appears on a single public blocklist and has been actively blocked by PhishDestroy. Reputation services assign a Gridinsoft trust score of 0 out of 100, indicating no confidence in the site’s legitimacy. The nameserver configuration lists ns1.mysecurecloudhost.com, ns2.mysecurecloudhost.com, ns3.mysecurecloudhost.com and an incomplete entry “ns”, which may reflect a misconfiguration often observed in malicious infrastructures.

Current operational status is offline, but the historical evidence confirms the domain was used for brand impersonation of Santander. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor the associated IP range for any resurgence, and update detection signatures to include the mismatched SSL certificate and the observed page title. Additional investigation of the host’s other domains and the registrar’s recent registrations may reveal further malicious actors.