tramites-x-procesos-oficiales[.]com

This domain, tramites-x-procesos-oficiales.com, is flagged as a phishing site targeting users of the Mexican Secretaría de Relaciones Exteriores (SRE), as indicated by the page title 'Cita Express - SRE México'. Analysis reveals the domain was registered on December 5, 2025, through Metaregistrar BV and is currently offline. Infrastructure analysis shows it resolved to the IP address 185.156.72.104, hosted on AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in France. The domain uses nameservers ns71.cloudns.net, ns72.cloudns.com, ns73.cloudns.net, and ns74.cloudns.uk, a configuration often associated with bulletproof or low-reputation hosting providers. Security vendors have detected malicious activity: 14 of 95 vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist, including PhishDestroy.

AlienVault OTX lists it in a threat intelligence pulse, further confirming its classification as a phishing threat. The SSL certificate is issued by Sectigo Limited (SL), which, while not inherently malicious, is commonly used in phishing campaigns due to its low cost and accessibility. The domain's Gridinsoft trust score is 0/100, reinforcing its high-risk status. Defenders should treat this domain as confirmed malicious infrastructure.

Block access at the network level, particularly to the IP 185.156.72.104, and monitor for related domains using the same nameserver pattern or hosting provider. Given the domain's offline status, it may reappear under a different IP or domain name. Security teams should review logs for connections to 185.156.72.104 or the domain itself, particularly from users who may have interacted with SRE-related services. No evidence of a specific phishing kit or additional brand impersonation beyond the page title is available, so further analysis of captured traffic or historical snapshots may be required to determine the full scope of the campaign.