gestiones-loginportal[.]com

Analysis of the domain gestiones-loginportal.com indicates a high‑risk credential phishing operation targeting users of the Cooperativa Ahorro y Crédito de Barranquitas brand, as suggested by the page title "Cooperativa Ahorro y Crédito de Barranquitas - ¡Nuestro centro eres Tú!". The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.78.209 located in the United States. DNS resolution uses Cloudflare nameservers bonnie.ns.cloudflare.com and seamus.ns.cloudflare.com, and the site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, confirming the use of a valid TLS chain. HTTP requests return a 302 redirect, a technique often employed to conceal malicious landing pages.

Google Safe Browsing flags the site for social engineering, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. VirusTotal reports that sixteen of ninety‑five security vendors have flagged the domain, and the domain appears on at least one public blocklist. The underlying web stack is identified as WordPress running on PHP with MySQL backend behind Nginx, and HTTP Strict Transport Security (HSTS) is enabled, suggesting an attempt to appear legitimate. PhishDestroy has already blocked the domain, but the site remains active as of the report date, July 23, 2026.

Defenders should block the resolved IP address and associated Cloudflare name servers, enforce URL filtering for the exact domain, and monitor for any credential submissions targeting the Cooperativa Ahorro y Crédito de Barranquitas brand. Continuous telemetry from DNS, SSL, and web‑proxy logs is recommended to detect any residual traffic. The limited public intelligence leaves the specific phishing page content unverified, so further sandbox analysis of the redirected URL would be prudent to confirm payload behavior.