produbanc0[.]webcindario[.]com

This domain, produbanc0.webcindario.com, is actively flagged as a high-risk brand impersonation site targeting Linea. Analysis indicates the domain resolves to IP address 5.57.226.202, hosted on AS29119 in Spain. The infrastructure is currently operational, returning an HTTP 200 status and utilizing a Let's Encrypt SSL certificate (R13). The domain appears on two security blocklists, PhishDestroy and PhishingDB, and is explicitly labeled for social engineering by Google Safe Browsing. Technical indicators reveal the use of Nginx as the web server, alongside Google Tag Manager and Google Analytics, which may facilitate tracking or malicious redirection. The domain was registered through Tucows Domains Inc. on February 28, 2001, though this date does not align with typical phishing domain lifecycles and may reflect a compromised or repurposed legacy domain. Nameservers are hosted under Google Cloud, which could provide resilience against takedowns. Security vendors on VirusTotal have flagged the domain, with 13 out of 95 engines detecting malicious activity. While this suggests a consensus on its risk level, the absence of additional context—such as the exact nature of the impersonation or payload delivery—limits definitive classification. The domain remains active as of July 12, 2026, and defenders should treat it as a live threat. Defenders are advised to block the domain and its resolving IP at the perimeter. Monitoring for connections to 5.57.226.202 or interactions with the domain’s nameservers (ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, ns-cloud-d3.googledomains.com) may help identify compromised endpoints. Given the use of Google Analytics and Tag Manager, reviewing logs for unexpected script loads or outbound requests to these services could reveal further indicators of compromise. No additional brand-specific artifacts or payloads have been confirmed, so detection rules should focus on the domain and IP as primary indicators.