seguridadbantrab[.]sbs

seguridadbantrab.sbs is currently offline but historical observations indicate it was used for a brand‑impersonation campaign targeting BANTRAB. The domain was registered on 21 February 2026 through Dynadot LLC and is served by the authoritative nameservers ns1.dyna‑ns.net and ns2.dyna‑ns.net. DNS resolution points to the IPv4 address 9.223.176.25, which belongs to the AS8075 Microsoft Corporation network and is geolocated to Sweden. No TLS certificate was observed, confirming the lack of HTTPS support at the time of capture.

The page title retrieved from the site reads “Bantrab en Línea — Personas”, matching the advertised brand target. The domain has been listed on a single security blocklist and is flagged by PhishDestroy as a malicious site. Threat intelligence sources corroborate the activity: AlienVault OTX includes the domain in one pulse, and VirusTotal recorded six positive detections out of ninety‑five scanners. Gridinsoft assigned a trust score of zero out of one hundred, indicating a high likelihood of abuse.

Although the site is no longer reachable, the combination of registrar information, hosting context, low trust rating, and multiple vendor detections provides sufficient evidence to classify the domain as a confirmed brand‑impersonation threat. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and include the associated IP address in threat‑intel feeds. Ongoing observation is recommended to verify whether the infrastructure reappears under a different domain or IP range.