mail[.]cigare-bassinarcachon[.]com

This domain, mail.cigare-bassinarcachon.com, is currently flagged as a high-risk credential-harvesting site targeting customers of a legitimate Arcachon cigar retailer. Analysis indicates the domain was registered on April 24, 2026, through Scaleway SAS and resolves to the IP address 173.208.166.166. The page title, 'Cigare Arcachon .com / Tabac Thiers La Teste : vente de cigare à Arcachon,' closely mimics the branding of the authentic retailer, suggesting an intent to deceive visitors into submitting login credentials or payment details. Infrastructure review reveals the domain is hosted on a Let's Encrypt SSL certificate, which provides HTTPS encryption but does not validate the legitimacy of the site. Google Safe Browsing has classified this domain under 'SOCIAL_ENGINEERING,' confirming its use in phishing campaigns. Additionally, the domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal, further supporting its malicious classification. The Gridinsoft trust score of 0/100 reinforces the assessment of high risk. Defenders should note that the domain remains active as of July 12, 2026, and continues to resolve to its assigned IP. There is no evidence of takedown requests or sinkholing at this time. The lack of historical WHOIS data or additional infrastructure details limits attribution, but the registration through a commercial provider and the use of a common hosting IP suggest opportunistic rather than targeted infrastructure. Organizations are advised to block this domain at the DNS and proxy levels, and to monitor for any internal traffic attempting to reach 173.208.166.166. End-user education should emphasize verifying domain authenticity before entering credentials, particularly for e-commerce sites impersonating regional retailers.