portal-clientes-gestiones[.]com

This domain is flagged as an active credential theft operation targeting users of Credicentro Coop, a financial cooperative. The site mimics legitimate customer portals to harvest login credentials, which may be used for unauthorized account access, fraudulent transactions, or further social engineering attacks. Analysis indicates the domain is designed to exploit trust in the Credicentro Coop brand, presenting a high-risk threat to individuals attempting to manage their accounts online. Infrastructure analysis reveals the domain was registered on June 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. As of the latest scan, only 2 out of 95 security vendors on VirusTotal have flagged the domain, suggesting limited detection at this stage. The domain resolves to the IP address 188.114.96.3 and has been identified in one threat intelligence pulse on AlienVault OTX, indicating early-stage blocklisting. The page title explicitly displays 'Credicentro Coop,' reinforcing its impersonation tactics. Users who have visited portal-clientes-gestiones.com or entered credentials on the site should immediately revoke any active sessions and change passwords for Credicentro Coop and any other accounts where the same credentials were reused. Enable multi-factor authentication (MFA) on all financial and email accounts to mitigate further risk. Monitor account statements for unauthorized transactions and report suspicious activity to Credicentro Coop’s official support channels. If personal or financial data was submitted, consider placing a fraud alert with credit bureaus and reviewing identity theft protection measures. Network administrators should block the domain and associated IP address (188.114.96.3) at the perimeter to prevent further exposure.