ibpsoluciones25[.]webcindario[.]com

The domain ibpsoluciones25.webcindario.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Linea brand. Intelligence indicates the site is being used for a cryptocurrency‑related scam, with the Google Safe Browsing service flagging it under the SOCIAL_ENGINEERING category. VirusTotal analysis shows that 16 out of 95 security vendors have identified the domain as malicious, reinforcing its elevated threat profile. Infrastructure analysis reveals that the domain was registered through Tucows Domains Inc. on 28 February 2001 and resolves to the IP address 5.57.226.202, which is allocated to AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL in Spain (AS29119). The authoritative nameservers are ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, and ns-cloud-d3.googledo, and the site presents a valid Let’s Encrypt certificate (R13). HTTP requests return a 200 status code, and the web server stack includes Nginx together with Google Tag Manager and Google Analytics. The Gridinsoft trust score of 0 / 100 and inclusion on the PhishDestroy and PhishingDB blocklists further confirm its malicious nature. While the available data confirm the domain’s role in a crypto scam and its impersonation of the Linea brand, the exact payload and user‑facing content have not been publicly disclosed, leaving some operational details uncertain. Defenders should prioritize blocking the domain and its associated IP address at network perimeters, enforce strict outbound traffic filtering to the identified nameservers, and monitor for related indicators such as the Let’s Encrypt certificate fingerprint and the Nginx server header. Continuous threat‑intel feeds should be consulted for any emerging variants that reuse the same registration or hosting infrastructure.