bono-davivienda[.]webcindario[.]com

Analysis indicates that the domain bono-davivienda.webcindario.com is currently active and associated with a generic phishing campaign. The domain resolves to the IPv4 address 5.57.226.202 and is hosted under the registrar TUCOWS.COM, CO. Registration records show the domain was created on February 28, 2001, suggesting the attacker is leveraging an aged domain to benefit from existing DNS reputation. DNS configuration lists three Google‑provided name servers (ns‑cloud‑d1.googledomains.com, ns‑cloud‑d2.googledomains.com, ns‑cloud‑d3.googledo), indicating the use of Google Cloud DNS infrastructure.

The domain appears on a single security blocklist and is specifically blocked by the PhishDestroy service. VirusTotal has recorded three positive detections out of ninety‑one scanned engines, confirming that multiple security vendors have identified malicious characteristics. No additional intelligence such as Safe Browsing, OTX indicators, SSL certificate details, HTTP response codes, or page title information is available in the current dataset.

Defenders should add the domain and its resolving IP address to outbound and inbound filtering rules, monitor DNS queries for the associated Google name servers, and consider sinkholing the IP if network control permits. Continuous re‑scanning with VirusTotal and periodic checks of blocklist status are advised to capture any changes in detection coverage. Given the active status and the presence of multiple detections, the threat should be treated as high risk until remediation actions confirm mitigation.