mediostresbarbas[.]com[.]ar

The domain mediostresbarbas.com.ar is currently classified as a high‑risk brand‑impersonation site and remains active as of 12 July 2026. Intelligence sources show the domain was registered on 02 August 2014 and resolves to the IP address 75.102.23.3, which is hosted in the United States under ASN AS23352 (DEFT.COM). The host presents a valid Let's Encrypt certificate (R13) and serves content over HTTP/3 via LiteSpeed, with backend components identified as WordPress, MySQL, and PHP. The site returns an HTTP 301 status code and its page title, "Medios Tres Barbas – Un producto de Tres Barbas," does not directly reveal any WordPress branding despite the infrastructure detection indicating a WordPress platform. Reputation data is uniformly negative: Gridinsoft assigns a trust score of 0/100, the domain appears on two external blocklists, and 15 of 95 VirusTotal scanners have flagged it. AlienVault OTX references the domain in six separate threat pulses, and it is actively blocked by both PhishDestroy and CryptoFirewall. The domain is listed under the scam type "Brand Impersonation" and is associated with the brand target "wordpress," suggesting an attempt to lure victims by mimicking legitimate WordPress‑related services. While the exact phishing payload or credential‑stealing mechanisms have not been publicly disclosed, the convergence of multiple blocklists, low trust score, and scanner detections indicates a credible malicious intent. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to 75.102.23.3, and consider adding the associated IP and nameservers (ns1.mediostresbarbas.com.ar, ns2.mediostresbarbas.com.ar) to threat intelligence feeds. Continuous observation is advised to detect any future changes in hosting or content that could affect the threat posture.