soportes-loginapp[.]com

Analysis of soportes-loginapp.com confirms an active credential-phishing campaign impersonating Cooperativa Ahorro y Crédito de Barranquitas, as indicated by the page title 'Cooperativa Ahorro y Crédito de Barranquitas - ¡Nuestro centro eres Tú!' observed in technical scans. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to 172.67.175.39, a Cloudflare IP (AS13335) located in the US. Infrastructure analysis reveals Cloudflare nameservers (bonnie.ns.cloudflare.com, seamus.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), consistent with tactics used to evade detection while maintaining HTTPS legitimacy. Technical indicators show a 302 HTTP redirect, suggesting the domain may act as an intermediate hop to a final phishing page.

Four of 95 security vendors on VirusTotal flag the domain, while PhishDestroy has explicitly blocked it. The domain appears on at least one security blocklist, and Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. Detected technologies include WordPress, MySQL, PHP, Nginx, and HSTS, which may be leveraged to host or obfuscate phishing content. Defenders should treat this domain as high-risk for credential theft targeting Cooperativa Ahorro y Crédito customers.

Recommended actions include blocking the domain and IP at network and endpoint levels, monitoring for related infrastructure (e.g., subdomains, redirect chains), and alerting users to verify URLs before entering credentials. The exact phishing kit or backend infrastructure remains unconfirmed, but the combination of Cloudflare hosting, low detection counts, and a 302 redirect aligns with evasion techniques observed in similar campaigns. Further analysis of redirect targets or associated domains may provide additional context.