Security Incident Report — `playcomla.com.ar`

Published: 2026-07-27 · Ref: PLAY-SEC-2026-07-27 · Status: Remediated

Summary

The website playcomla.com.ar was compromised by an unauthorized third party that hosted phishing content on the server. The incident was detected and fully remediated on 2026-07-27. The initial compromise date is under review from available logs. This document serves as a public proof-of-cleanup for reputation services and blocklists.

Scope

Affected: playcomla.com.ar (institutional website only).
Not affected: email services, authoritative DNS, customer platform, access networks, and other domains managed by Playcom.
Customer data: no evidence of exfiltration of customer or internal Playcom data. Impact is limited to external users who may have been deceived by the phishing page.

Current site state

As part of remediation, the site was reduced to the minimum. playcomla.com.ar currently serves only two static files:

index.html — static redirect to https://playcom.com.ar/.
This security report (security-incident-2026-07-27.html).

No CMS, admin panel, dynamic endpoints, forms, uploads or exposed database. Any other path returns HTTP 404. This eliminates the attack surface until a new, audited version is deployed.

Remediation actions

Removed all files identified as part of the phishing kit.
Audited the full site tree for webshells, suspicious uploads and unauthorized modifications to .php, .js and .html files.
Reviewed cronjobs, scheduled tasks and admin accounts; removed anything created by the attacker.
Rotated all credentials: CMS, hosting panel, FTP/SFTP, SSH and database.
Reviewed authorized SSH keys on the server; removed unknown ones.
Reviewed access and application logs to bound the entry vector and compromise window.

Contact

Security reports, external verification, or questions about this incident:

Email: abuse@playcomla.com.ar
Site: https://playcomla.com.ar/