vidasalud[.]com[.]ar

This domain, vidasalud.com.ar, resolves to the IPv4 address 149.50.132.55 located in Argentina and advertised as part of AS27823 (Dattatec.com). The web server responds with HTTP 200 and is identified as Nginx, presenting a page titled “Vida Salud | Centro Médico – Vida Salud | Centro Médico”. The site presents a publicly trusted SSL certificate (issued by a free certificate authority, identifier E7). Registration data indicates the domain was created on 20 August 2013 and is managed by the registrar nicar, with four hostmar.com name servers. Intelligence sources classify the site as a brand‑impersonation campaign targeting Facebook, employing a social‑media phishing kit. VirusTotal analysis shows 13 of 95 scanners flag the domain, and AlienVault OTX lists the indicator in 18 pulses. The domain is currently blocked by PhishDestroy and PhishingDB, appearing on two security blocklists. While the exact phishing landing page content has not been publicly disclosed, the combination of brand targeting, active hosting, and multiple detections confirms a high‑risk profile. Defenders should block the domain and its IP at perimeter defenses, monitor DNS queries for the domain and its name servers, and add the indicator to internal threat feeds. Continuous re‑evaluation is advised in case the site changes hosting or content.