hostmaiws1[.]webcindario[.]com

Analysis of hostmaiws1.webcindario.com shows a high‑risk brand‑impersonation campaign targeting Microsoft users. The site resolves to IP 5.57.226.202, which belongs to AS29119 AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL in Spain. Registration was performed through Tucows Domains Inc. on March 14 2026, and the domain remains active with an HTTP 200 response. Google Safe Browsing classifies the URL under SOCIAL_ENGINEERING, and PhishDestroy has already blocked it. The TLS certificate is issued by Let’s Encrypt (R13), and the authoritative nameservers are ns‑cloud‑d1.googledomains.com, ns‑cloud‑d2.googledomains.com, and ns‑cloud‑d3.googledomains.com. The page title "Iniciar sesión en tu cuenta Microsoft" and the declared scam type of Tech Support Scam indicate a credential‑harvesting intent. Detected web technologies include Nginx, jQuery, Google Tag Manager, Google Hosted Libraries, Google Analytics, Google AdSense, and Funding Choices, suggesting a standard web stack with extensive third‑party tracking. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. VirusTotal reports 19 of 94 scanners flagging the domain, reinforcing the malicious assessment. Uncertainties remain regarding the full payload delivered after initial page load, as the site content has not been directly inspected. Defenders should block the domain at network perimeter, update URL filtering policies to include the host and its IP, monitor for related indicator traffic, and alert users about the fraudulent Microsoft login prompt. Continuous re‑evaluation is advised should additional indicators emerge.