“Argentina LNG” fraud using the YPF brand: observed campaign and a hypothesis of an international link

Observed campaign and attribution limits

The campaign called “Argentina LNG” used the image of Argentina's President, energy brands and a copy of LA NACION as investment lures. The documented path combines ads, a fake news article, a form collecting name, email and phone number, and later contact from supposed advisers. The people, news outlet and companies mentioned are impersonated parties, not perpetrators of the fraud.

Originally published on August 31, 2026, this analysis follows the August 28 “Argentina LNG” alert. Activity, domains and calls are described within that historical period. The destinations are not presented as currently active outside that historical period.

The investigation records eight advertiser accounts, access-dependent redirects and domain rotation. It also compares the path with “Swap Adipex AI”, described by iQBlack. The observed campaign and the international-link hypothesis are different levels of evidence.

The false offer and impersonated entities

The lure copied LA NACION's typography, logo and navigation: Política, Foodit, Club LN and Mi cuenta. The fake page linked the offer to YPF, Eni and XRG and included a montage of the President at an alleged summit with executives. Its institutional appearance was part of the persuasion.

The piece attributed an invented statement to a journalist, offering “6,900,000 ARS per month” to each participant. This was the lure's promise, not an observed return. The fake article, brands and montage do not establish those parties' support for the investment.

The impersonation combines four elements: the presidential image, a fake journalistic quote, the newspaper's visual identity and YPF / Eni / XRG branding. This analysis concerns that offer and collection path, not the existence or nonexistence of every energy project with a similar name.

Documented distribution, cloaking and infrastructure

Two responses according to access profile

The investigation documented Gmail Promotions ads aimed at users in Argentina, with greater advertising activity observed at night. In the tests performed, the chain activated on iOS/Android phones. That result is not a verified rule for every device or time.

Mobile path: Gmail click → uedaira[.]com or skavrix[.]digital → fake LA NACION article → form → contact confirmation. Desktop or direct access: a horoscope portal with contact details described as fictitious. That difference supports the case's segmentation and cloaking analysis.

Indicators and described roles

The report associates the campaign domains with the historical IP 178[.]16[.]52[.]96. The public list retains the described roles, not updated status:

• uedaira[.]com: page carrying the cloned article.
• skavrix[.]digital: redirect destination.
• ozrima[.]digital / adwernews[.]com: advertising redirection.
• clayparcel[.]digital / inkbarrel[.]digital: traffic rotation.
• tafmira[.]digital / tafmir[.]digital: mirror domains.

tomboy-clothing[.]com was observed as an intermediary. Its possible status as a compromised legitimate shop requires validation; it does not authorize attributing control of the campaign to it.

The investigation records more than 60 co-hosted domains on the same IP. That figure is not more than 60 confirmed fraud domains. The expanded list is not published and the original text makes it available to response teams. Shared hosting alone is not grounds to add it wholesale to blocking.

What the eight advertiser accounts show

The eight identified Google Ads accounts appeared associated with small US businesses unrelated to energy or the Latin American market. The case is consistent with stolen credentials or purchased access, but did not determine the mechanism. Appearing as an advertiser does not prove who controlled the account or destination.

Names removed from the public version remain omitted. The businesses are not presented as fraud operators, and the abuse description is not independent verification of their credentials.

From the form to phone calls

The investigation describes calls from supposed financial advisers within 24 hours of form submission, using pressure and retries over several days. The sequence places an important part of the deception outside the web page: collecting contact information precedes persuasion by phone.

Organized repeated calls are consistent with a call center. Its location was not confirmed. The timing and behavior are reported in the historical case, not a new measurement of everyone who submitted a form.

“Swap Adipex AI”: a single-source comparison

The article cites iQBlack record 3C-INT, dated March 20, 2026. It compares five features against that source: fake news → form → call; crypto or energy offers; public figures as lures; cloaking, bridge pages and rotation; and vishing.

TDS.SO appears in the “Argentina LNG” evasion description. Central American call centers belong to the description attributed to the compared source; they are not a confirmed location for this case. Similarities support a research lead, not operator identity or a closed attribution.

Conclusions and reuse

The historical case documents trust impersonation, advertising, selective presentation and phone contact. It does not prove all shared infrastructure is malicious or that compared cases have the same perpetrator.

For defense teams, the proposal is to retain records and assess campaign indicators in context before taking action. The shared IP and intermediary require particular attention to false positives. No indiscriminate blocklist is recommended and current domain validity is not certified here.

Preventive communication should identify the false offer, impersonated brands and promises it used. Ads can be reported to the platform and evidence preserved for competent authorities. This article is not legal or financial advice and does not establish that a formal complaint was filed.

Collaboration and versions

This investigation benefited from the iQBlack platform and its analyst team, led by Jorge Mieres. The single-source hypothesis does not constitute independent corroboration.

The downloadable version has been temporarily withdrawn while it is updated. The current content is the one on this page.