helguerosport[.]com[.]ar

Analysis of helguerosport.com.ar confirms active phishing infrastructure targeting Banco de Venezuela customers. The domain, registered on September 25, 2014, through nic.ar, currently resolves to 167.250.5.65 (AS264649, Argentina) and hosts a site titled 'BDVenlínea personas,' directly referencing the bank's online banking portal. While the domain's age might suggest legitimacy, multiple technical indicators confirm malicious intent: Google Safe Browsing classifies the site as 'SOCIAL_ENGINEERING,' and 21 of 95 security vendors in VirusTotal flag it as malicious. The domain appears on two security blocklists and has been documented in 17 AlienVault OTX threat intelligence pulses. Infrastructure analysis reveals the use of Nginx and jQuery, common in phishing kits, and a Let's Encrypt SSL certificate (R13), which provides HTTPS encryption but does not validate content legitimacy. Nameservers point to dns1.servidoraweb.net, dns2.servidoraweb.net, ns1.nuthost.com, and ns2.nuthost.com, which have been associated with other phishing campaigns. The site remains operational, returning an HTTP 200 status, and is actively blocked by PhishDestroy and PhishingDB. Defenders should treat this domain as high-risk. The combination of brand impersonation, social engineering classification, and cross-vendor detections justifies immediate blocking at the network and endpoint levels. While the exact phishing kit or payload is not yet analyzed, the page title and known intelligence confirm the target as Banco de Venezuela's customer login portal. Further investigation into the hosting provider (NUT HOST SRL) and nameserver infrastructure may reveal additional linked domains.