news[.]cistronixperu[.]com

Analysis of the domain news.cistronixperu.com indicates active involvement in crypto-related phishing operations, with multiple technical indicators supporting its malicious classification. The domain was registered on May 12, 2004, through Hosting Concepts B.V. d/b/a Registrar.eu, and currently resolves to the IP address 173.236.253.23, hosted by DreamHost in the United States. Despite its long registration history, the domain exhibits characteristics consistent with recent malicious activity, including a 301 HTTP redirect status and a Scamadviser trust score of 1 out of 100, suggesting minimal legitimacy. Infrastructure analysis reveals the use of WordPress as the underlying content management system, alongside MySQL, PHP, and Apache HTTP Server. Additional technologies detected include All in One SEO, Moment.js, jQuery Migrate, and jQuery, which are commonly exploited in phishing campaigns to enhance functionality or evade detection. The domain is flagged by 10 out of 95 security vendors on VirusTotal, and it appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let’s Encrypt (R12), a detail often leveraged by threat actors to lend superficial credibility to malicious sites. The page title, 'Just another WordPress site,' is a default placeholder, further indicating a lack of legitimate configuration or intent. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing its classification as high-risk. While the domain’s age might suggest historical legitimacy, its current behavior aligns with crypto scam operations, a pattern observed in other recently compromised or repurposed domains. Defenders should treat this domain as actively malicious and prioritize blocking or monitoring any connections to 173.236.253.23 or associated subdomains. Further investigation into the hosting infrastructure may reveal additional linked domains or campaigns.