es-clientes-onlineapp[.]com

Analysis of the domain es-clientes-onlineapp.com indicates active brand impersonation targeting Linea, a financial services entity. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. As of July 23, 2026, the domain resolves to IP address 172.67.212.28, hosted on Cloudflare's network (AS13335) in the United States. The HTTP response code is 302, suggesting a redirect mechanism commonly employed in phishing campaigns to obscure the final malicious destination. The page title, 'Cooperativa Ahorro y Crédito de Barranquitas - ¡Nuestro centro eres Tú!', implies an attempt to mimic a legitimate credit union, though no direct evidence confirms this as the final phishing page content.

Security vendor detection remains limited, with only 3 of 93 engines on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist, specifically PhishDestroy, and has received low trust scores from Gridinsoft (0/100) and Scamadviser (40/100). SSL certification is provided by Google Trust Services (WE1), a common but not inherently suspicious certificate authority. Infrastructure analysis reveals the use of Cloudflare nameservers (cortney.ns.cloudflare.com and nikon.ns.cloudflare.com), which may complicate takedown efforts. Detected technologies include WordPress, MySQL, PHP, Nginx, and HSTS, a combination often seen in both legitimate and malicious sites.

The scam type is classified as brand impersonation, though the exact tactics—such as credential harvesting or malware distribution—remain unconfirmed due to the lack of deeper forensic analysis. Defenders should treat this domain as high-risk due to its active status, brand impersonation classification, and association with a known high-risk registrar. Network-level blocking of the IP 172.67.212.28 and domain-based filtering are recommended.