es-portal-alertas[.]com

This domain is flagged as an active credential phishing site targeting users of Credicentro Coop, a financial cooperative. Analysis indicates the threat type is highly specific, focusing on harvesting login credentials through fraudulent portal pages mimicking legitimate financial services. The risk level is elevated due to the targeted nature of the campaign and the potential impact on victims' financial security. Infrastructure analysis reveals the domain es-portal-alertas.com was registered on June 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.130.180, which is associated with a content delivery network known for obfuscating malicious infrastructure. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to phishing sites. As of the latest scan, only 1 out of 95 security vendors on VirusTotal have flagged this domain, suggesting either low detection rates or recent activation. The page title explicitly references Credicentro Coop, confirming the targeted impersonation of this financial institution. Mitigation steps for this specific threat type include immediate blocking of the domain and IP address at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to es-portal-alertas.com or similar patterns. End users should be educated on recognizing credential phishing tactics, particularly those impersonating financial institutions, and instructed to verify URLs through official channels before entering sensitive information. Monitoring for unauthorized access attempts using credentials potentially compromised through this campaign is recommended, along with enforcing multi-factor authentication for all financial service accounts.