pacificar-ec[.]webcindario[.]com

Analysis indicates that pacificar-ec.webcindario.com is currently classified as a generic phishing site with a high risk rating. The domain is actively serving content (HTTP 200) and presents a page titled “Inicio”. No legitimate branding is observed, consistent with the generic phishing label. Infrastructure assessment shows the domain resolves to IP 5.57.226.202, hosted by Miarroba Networks in Spain. The domain was created on 28 February 2001 and is registered via TUCOWS.COM, CO. Nameservers are Google’s cloud DNS (ns-cloud-d1 through ns-cloud-d3). A valid Let’s Encrypt certificate (R13) encrypts traffic, which is typical for abuse operators seeking HTTPS legitimacy. Reputation metrics reinforce the malicious assessment. Gridinsoft assigns a trust score of 0/100 and Scamadviser a score of 1/100. VirusTotal reports that 10 of 95 security scanners flag the domain, and the domain appears on at least one public blocklist. PhishDestroy currently blocks the site, confirming active mitigation. Open questions remain regarding the specific lure and targeted brand, as the captured page title provides no direct clues. The content behind the initial page has not been disclosed, and no indicator of compromised credentials or data exfiltration has been observed. Therefore, the full scope of the phishing campaign cannot be quantified at this time. Defenders should proactively block both the domain and its resolved IP address at perimeter and endpoint layers. Continuous monitoring of the domain’s DNS records is advised, as changes to nameservers or IP could signal migration. Incorporate the domain and IP into threat intelligence feeds, and educate users to distrust unsolicited communications that reference this URL.