popcashsp[.]com

The domain popcashsp.com was registered on February 10, 2025 through the Hostinger Operations UAB registrar and is currently taken offline. Technical analysis shows the domain resolves to IP address 185.255.122.94, which is associated with Virtual Systems LLC in Ukraine (AS30860). The authoritative nameservers are ns1.freednsdedi.com and ns2.freednsdedi.com, both typical of free DNS hosting services. No TLS certificate is presented for the site, indicating HTTP‑only delivery.

The page title returned by the server is "Ativação do Microsoft Office", and the domain is explicitly flagged as impersonating Microsoft in a tech‑support scam context. VirusTotal scans have recorded eight detections out of ninety‑five security vendors, confirming malicious classification by multiple engines. The domain appears on one public blocklist and is listed as blocked by the PhishDestroy service, demonstrating that at least one defensive feed is already distributing indicators of compromise. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation of the host.

While the available data confirms the domain’s use for brand‑impersonation and tech‑support fraud, the exact payload or victim interaction flow has not been captured, leaving the specifics of the scam kit unknown. Defenders should continue to block the IP 185.255.122.94 and the domain popcashsp.com at perimeter filters, monitor for any re‑registration attempts, and update threat‑intel feeds with the observed indicators. Additional investigation of HTTP responses, potential redirects, and any associated command‑and‑control infrastructure would be required to fully map the campaign’s scope.