activacoomeva[.]webcindario[.]com

This domain, activacoomeva.webcindario.com, is identified as a credential theft phishing infrastructure targeting users through deceptive login portals. Analysis indicates the site was designed to harvest account credentials, likely for financial or email services, by mimicking legitimate authentication pages. The threat poses a high risk to individuals who may unknowingly submit sensitive information, leading to unauthorized account access or identity fraud. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 28, 2001, though the phishing activity appears to be a more recent misuse of the subdomain. It resolves to IP address 5.57.226.202, hosted on a Spanish network (AS29119 AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL). Security vendors flagged the domain on VirusTotal, with 16 out of 95 engines detecting malicious activity. Additionally, it appears on two security blocklists, including PhishDestroy and PhishingDB, and was previously flagged by Google Safe Browsing for phishing. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to fraudulent sites. Users who visited activacoomeva.webcindario.com or entered credentials on the site should take immediate action to mitigate risks. First, change passwords for any accounts accessed or submitted through the domain, prioritizing email and financial services. Enable multi-factor authentication where available to prevent unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or transactions. If personal or financial data was exposed, consider reporting the incident to relevant authorities or identity protection services. The domain is currently offline, but users should remain vigilant for similar phishing attempts via email or other channels.