redsaludsac[.]com

The domain redsaludsac.com is currently active and classified as a high‑risk generic_phishing site. The site returns HTTP 200 and is hosted on a server in Peru (AS265794 ARTIC TELECOM E.I.R.L) at 192.141.41.65. The certificate is issued by Let’s Encrypt (R13). Registration data shows creation on 22 Mar 2019 via ENOM, INC., and the domain uses the nameservers ns1.hostinglabs.net, ns2.hostinglabs.net, ns3.hostinglabs.net. Content analysis reveals a WordPress installation with MySQL, PHP, Yoast SEO, LiteSpeed, Slider Revolution and HTTP/3 support. The page title observed is “Inicio ‑ Red Salud”. Threat intelligence indicates the domain appears in 18 AlienVault OTX pulses and has been listed on two public blocklists, including PhishDestroy and PhishingDB. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 13 of 95 security scanners flagging the domain. While the specific phishing lure and victim targeting have not been disclosed, the combination of high‑risk classification, low trust score, and multiple detections suggests an active credential‑harvesting operation. Defenders should block the domain and associated IP at network perimeter, monitor DNS queries for the listed nameservers, and consider adding the IP and ASN to threat‑intel feeds. Ongoing observation of any changes to the site’s infrastructure or additional detections is recommended.