mail[.]ameport[.]org[.]ar

Analysis indicates that the domain mail.ameport.org.ar was registered on 21 February 2026 and is currently listed as taken offline. The domain resolves to the IPv4 address 66.97.42.214, which belongs to the AS27823 Dattatec.com network in Argentina. DNS resolution uses five authoritative nameservers (A.LACTLD.ORG, C.DNS.AR, D.DNS.AR, E.DNS.AR, F.DNS.AR). An HTTPS endpoint is available with a Let’s Encrypt certificate issued under the R13 renewal schedule, confirming that TLS termination is handled by the web server. HTTP requests return a 200 OK status and the sole page title returned is “Index of /”, suggesting a default directory listing rather than a crafted landing page.

The web server identified by fingerprinting is Nginx. Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. VirusTotal scans report that 15 of 93 antivirus and URL scanners flag the domain, indicating a measurable level of malicious detection. The domain has been blocked by the PhishDestroy feed, which classifies it as part of a generic phishing operation. Registration data indicates the registrar information was supplied repeatedly as “nicar”.

No additional intelligence such as payload samples, credential harvesting pages, or target brand details is present in the current dataset. Consequently, the precise phishing vector, targeted victims, and lure content remain unknown. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole lists, and monitor for any resurgence of the IP address or associated nameserver patterns. Given the low trust score, multiple vendor detections, and confirmed blocklist inclusion, the domain should be treated as high‑risk until further forensic evidence clarifies its activity. Ongoing observation of the hosting ASN and any new DNS records is recommended to detect possible re‑use.