ingdirect-webincidencias[.]com

Analysis indicates that the domain ingdirect-webincidencias.com is an active phishing site targeting users of Cooperativa Ahorro y Crédito de Barranquitas, as evidenced by the page title 'Cooperativa Ahorro y Crédito de Barranquitas - ¡Nuestro centro eres Tú!' retrieved on July 23, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.97.3, which is hosted on Cloudflare's network (AS13335, United States). Infrastructure analysis reveals the use of Cloudflare nameservers (bonnie.ns.cloudflare.com and seamus.ns.cloudflare.com), along with an SSL certificate issued by Google Trust Services (WE1), suggesting an attempt to appear legitimate through encrypted connections. The site returns an HTTP 302 redirect status, which is commonly employed in phishing campaigns to obscure the final destination or to dynamically serve malicious content.

Detection data shows that the domain is flagged by one security blocklist, and four out of 93 security vendors on VirusTotal have classified it as malicious. Gridinsoft assigns a trust score of 0/100, further supporting the assessment of high risk. Technologies detected on the domain include WordPress, MySQL, PHP, and Nginx, which are frequently used in both legitimate and malicious websites, though their presence here does not confirm the specific phishing kit in use.

Defenders should note that the domain remains active as of the report date, and its infrastructure leverages Cloudflare's services, which may complicate takedown efforts. Organizations are advised to block the domain and associated IP address at the network level and monitor for related indicators of compromise. The exact content and functionality of the phishing page have not been fully analyzed, but the combination of the page title, detection counts, and infrastructure characteristics align with known phishing tactics targeting financial institutions.