r3g1strat3-aqu1[.]webcindario[.]com

r3g1strat3-aqu1.webcindario.com is currently hosting a page titled “Creditos Pichincha‑Banca Movil”. The content mimics the mobile banking interface of the Creditos Pichincha brand, suggesting an attempt to harvest credentials from customers of the institution. The site returns HTTP 200 and presents a fully qualified SSL certificate issued by Let’s Encrypt (R13), indicating a legitimate‑looking HTTPS connection. The domain resolves to IP address 5.57.226.202, which is assigned to AS29119 AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL and geolocated in Spain. The web server identifies as Nginx and loads client‑side libraries such as List.js, as well as several Google services including Tag Manager, Analytics, and AdSense. Funding Choices is also detected, pointing to the use of third‑party monetization scripts. Authoritative name servers are ns‑cloud‑d1.googledomains.com through ns‑cloud‑d3.googledomains.com, and the domain was registered through Tucows Domains Inc. on 10 March 2026. VirusTotal has marked the domain as malicious, with 16 of 95 scanning engines raising detections. The site appears on a single public blocklist and has been added to the PhishDestroy repository, confirming active use by threat actors. The classification as generic phishing aligns with the observed credential‑stealing page template. The relatively recent creation date suggests a fast‑track deployment, common in campaigns that recycle inexpensive hosting services. Defenders should add 5.57.226.202 and the host name r3g1strat3-aqu1.webcindario.com to web‑filter and DNS blocklists, monitor outbound connections to the identified Google endpoints for suspicious payloads, and enforce multi‑factor authentication for Creditos Pichincha customers to mitigate credential reuse. Continuous threat‑intel feeds should be consulted for any re‑use of the same infrastructure in future campaigns.