ingdirect-soporte-seguro[.]com

This domain, ingdirect-soporte-seguro.com, is flagged as an active phishing site targeting users of Credicentro Coop, as indicated by the page title 'Credicentro Coop' observed during analysis. Registered on June 17, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains operational despite appearing on one security blocklist. Infrastructure analysis reveals Cloudflare-hosted nameservers (isabel.ns.cloudflare.com and remy.ns.cloudflare.com) and resolution to IP 188.114.97.3, part of AS13335 Cloudflare, Inc. network in the US. The site employs a Google Trust Services SSL certificate (WE1) and returns an HTTP 302 redirect, suggesting dynamic content handling or evasion tactics. Technical indicators include the use of WordPress, MySQL, PHP, and Nginx, alongside HSTS and Google Tag Manager, which may facilitate credential harvesting or tracking. Detection by three of ninety-five security vendors on VirusTotal and inclusion in one AlienVault OTX threat intelligence pulse further corroborate malicious intent. The domain's recent creation, combined with its immediate use in phishing operations, aligns with patterns observed in short-lived credential theft campaigns. Defenders should prioritize blocking this domain at DNS and web proxy levels, particularly for networks serving regions associated with Credicentro Coop. The HTTP 302 response warrants investigation for potential redirect chains leading to additional malicious endpoints. Given the domain's Cloudflare infrastructure, takedown efforts may require coordination with the hosting provider. No evidence currently links this domain to broader malware distribution or advanced persistent threats, but monitoring for secondary payloads is recommended.