control-accesosweb[.]com

Analysis of control-accesosweb.com indicates a confirmed credential phishing operation active as of July 23, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to Cloudflare IP 188.114.97.3 (AS13335, US). Nameservers jarred.ns.cloudflare.com and kenia.ns.cloudflare.com further confirm Cloudflare hosting, a common tactic to obscure origin infrastructure and evade takedowns. The page title explicitly references 'Cooperativa Ahorro y Crédito de Barranquitas - ¡Nuestro centro eres Tú!', suggesting a targeted phishing campaign against members of this financial institution. Detection data remains limited but actionable: two of 93 security vendors on VirusTotal flag the domain, and it appears on at least one blocklist (PhishDestroy).

The domain earns a Gridinsoft trust score of 0/100, reinforcing its malicious classification. Technical indicators include a 302 HTTP redirect, which may lead victims to a credential-harvesting page, though the final destination remains unconfirmed. The site uses WordPress, MySQL, PHP, and Nginx, with HSTS enabled—common technologies that do not inherently indicate malicious activity but are frequently exploited in phishing kits. The SSL certificate is issued by Google Trust Services (WE1), providing no additional risk signal. Defenders should prioritize blocking this domain at DNS and web proxy layers, particularly for networks serving users in regions associated with Cooperativa Barranquitas.

The Cloudflare IP and nameservers should be monitored for additional malicious domains, as threat actors often reuse hosting infrastructure. While the registration date (February 2026) is recent, it does not deviate from typical phishing domain lifecycles. No evidence currently links this domain to broader malware distribution or advanced persistent infrastructure, but credential phishing remains a high-risk threat vector for financial institutions.