winpopcach[.]com

On 23 July 2026 analysts observed that the domain winpopcach.com has been taken offline but remains listed as an elevated‑risk brand‑impersonation site targeting Microsoft. The site was registered on 3 January 2025 through HOSTINGER operations, UAB and resolves to the IPv4 address 185.255.122.94, which belongs to ASN 30860 (Virtual Systems LLC) located in Ukraine. The domain uses the authoritative name servers ns1.freednsdedi.com and ns2.freednsdedi.com and does not present an SSL/TLS certificate, indicating that communications are unencrypted. The only visible page title retrieved during the brief live investigation was “Ativação do Microsoft Office”, matching the known Microsoft‑focused tech‑support scam vector.

Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single external blocklist; it is also listed as blocked by PhishDestroy. VirusTotal analysis returned 13 positive detections out of 95 scanned engines, providing independent confirmation of malicious intent. No additional public intelligence such as OTX artifacts or Safe Browsing entries was supplied. The lack of active hosting precludes further content inspection, so the exact payload or credential‑harvesting mechanisms remain unknown.

Defenders should continue to deny any resolved queries to 185.255.122.94 at the network perimeter, enforce DNS sink‑holing for winpopcach.com, and add the domain to endpoint and email filtering policies that flag Microsoft‑related impersonation content. Monitoring of the associated IP range and name‑server infrastructure is recommended to detect possible re‑hosting attempts, and any future resurrection of the domain should be evaluated against the same indicators of compromise. The presented indicators—registration data, hosting ASN, lack of TLS, page title, trust score, blocklist entries, and VirusTotal detections—constitute a concise evidence set for threat‑hunting and remediation activities.