patrimonia[.]site

On July 25 2026, the domain patrimonia.site was identified as an active generic phishing site. The domain resolves to the IP address 194.36.184.150, which is allocated to Hostinger International Limited in the United Kingdom (AS47583). The hosting infrastructure advertises LiteSpeed web server, supports HTTP/3, and serves content over a valid Let’s Encrypt certificate (R13). An HTTP GET returns status 200 and the page title “Patrimonia | Iniciar Sesión”, indicating a login‑oriented landing page. The site is built with PHP and includes client‑side libraries such as Chart.js and jsDelivr, consistent with a typical dynamic web application.

Nameservers are ns1.dns-parking.com and ns2.dns-parking.com, both associated with generic parking services. The domain was registered on 25 December 2025 through Hostinger operations, UAB, and has not changed ownership since creation. Reputation checks show a Gridinsoft trust score of 0 out of 100, reflecting extreme lack of trust. VirusTotal analysis recorded detections by two of ninety‑three scanning engines, confirming malicious behavior, and the domain appears on one external blocklist. Additionally, the phishing‑specific blocklist PhishDestroy has listed patrimonia.site, indicating that the site is already recognized by anti‑phishing communities.

While the page title suggests a credential‑collection portal, the exact content of the landing page has not been publicly disclosed, leaving the precise phishing vector uncertain. No additional intelligence such as OTX references, Safe Browsing alerts, or brand‑specific impersonation details are present in the current data set. Defenders should block network traffic to 194.36.184.150 and to the domain patrimonia.site at perimeter and DNS layers. Email security gateways should add the domain to URL and attachment filtering rules, and security‑aware users should be warned that any login prompt originating from this domain is likely fraudulent.