Reading contents
What the August 28 alert documented
Originally published on LinkedIn on August 28, 2026, before the full investigation. Domains are defanged with brackets ([.]) to prevent accidental clicks.
The title and description were updated to accurately reflect the content; the page address did not change. Advertiser account names and the PDF version were withdrawn.
The alert described investment ads using the image of Argentina's President, YPF branding and LA NACION's design under the name “Argentina LNG”. The lure sought personal information and continued the deception by phone. The described offer was false; the people and brands were impersonated.
“Active” refers to August 28, 2026. It is not a current check of the form, ads or domains. The later investigation develops the path and its reservations in the “Argentina LNG” analysis and attribution limits.
This distinction also avoids extending the alert to every energy project with the same name. The case concerns the offer in the ads and fake pages, not a general claim about real projects outside the observed material.
Why a desktop visit could show a different page
The original analysis identifies a traffic distribution system, TDS.SO, and describes segmentation by country, device, browser, language, time and ISP. In the documented path, a phone arriving from advertising could receive the lure while a desktop review ended on a horoscope page.
The difference explains why one visit to a harmless façade is insufficient to reconstruct the ad's path. The text calls this selective presentation cloaking. TDS.SO is mentioned as the described mechanism, not as a recommendation or attribution of campaign operation to the provider.
The alert also claims migrations within 24 hours that retain clicks and conversions. This remains a statement in the historical record, pending corroboration against migration records before reuse as an operational metric. It is not presented as a guaranteed capability or a fresh measurement.
Findings in that earlier update
The count increased from two to eight identified Google Ads accounts, associated with small US gardening, moving, construction, apparel, beauty and hospitality businesses. The later analysis says the access mechanism was not determined. Names remain omitted; these businesses are not accused of running the fraud.
The reference to more than 60 domains describes shared infrastructure. The full investigation warns that co-hosting does not establish involvement. The figure should not be read as a list of more than 60 confirmed campaign indicators.
The form displayed “an operator will contact you”. The alert linked it to a phone-based vishing phase; the later investigation describes calls and retries. The visible message and that historical sequence do not establish current call-center activity.
Published domains and limits on their use
The partial case list contains uedaira[.]com, skavrix[.]digital, ozrima[.]digital, adwernews[.]com, clayparcel[.]digital, inkbarrel[.]digital, tafmira[.]digital and tafmir[.]digital. Brackets prevent treating them as operational links; do not visit them to check this alert.
tomboy-clothing[.]com appears because of its observed intermediate role. It may have been a compromised legitimate shop; that hypothesis requires validation before attribution or blocking. The wider co-hosted list is not converted into campaign indicators here.
The eight advertiser accounts remain part of the record, with names reserved for authorities and response teams. This editorial revision does not make a new Google Ads query or recover account holders' private information.
Responding to an offer that repeats this lure
The case's prevention advice is not to enter information, complete forms or transfer money at its destinations. Share the investigation and its date, rather than campaign links or an unverified assertion that it is still active.
The original publication referred to reporting an ad through Google Ads and mentioned UFECI or consumer protection. Channels and remits can change; verify official sources before filing a report. The note is not itself a formal complaint.
For DNS/proxy use, domains should be assessed with evidence and context. Blocking is not proposed merely because of shared hosting or a business's appearance as an advertiser.
Limits of the alert
The advertiser brand, impersonated brand and operator are different entities. A business appearing in an ad is not sufficient proof of its participation. Nor does this alert confirm the international link discussed as a hypothesis in the full analysis.
The alert serves research and prevention, not financial or legal advice. Activity, migration speed and account claims retain their dates and reservations rather than being presented as newly verified.
Three trust cues in one lure
The presidential image suggests official endorsement; the LA NACION copy supplies a news-like presentation; and YPF provides brand recognition. The analysis interprets their combination as an attempt to lower distrust. It does not measure the effect on every user or establish that those entities endorse the investment.
Case continuity and evidence
The later campaign analysis distinguishes described domains, calls, co-hosting and the “Swap Adipex AI” hypothesis. As in the original publication, full technical evidence is offered to authorities and response teams through contacto@cyberthreatintelligence.lat.
Ezequiel Jorge La Terra · ORCID 0009-0008-1677-4218 · Text licensed under CC BY 4.0.
How to cite: La Terra, E. J. (2026). Alert: investment scam impersonating the President and YPF under the “Argentina LNG” brand. Cyber Threat Intelligence LATAM. Updated Aug 28, 2026. https://cyberthreatintelligence.lat/en/blog/argentina-lng-alert-president-journalist-scam-still-active/
Get new notes by email
When a new note comes out, I send you an email. No promotions and no sharing of your address.
Thank you, you are on the list. I will let you know when a new note comes out.