ingresaahoramx[.]webcindario[.]com

Analysis of ingresaahoramx.webcindario.com indicates that the domain is actively leveraged in a credential harvesting campaign as of the report date 25 July 2026. The domain was registered through TUCOWS.COM in Colombia and has a creation timestamp of 28 February 2001, suggesting long‑term ownership that may be used to lend perceived legitimacy. DNS resolution points to the IPv4 address 5.57.226.202, and the authoritative name servers are ns-cloud-d1.googledomains.com, ns-cloud-d2.googledomains.com, and ns-cloud-d3.googledo, all of which are typical of cloud‑based DNS services.

The domain appears on a single security blocklist and is explicitly listed as blocked by the PhishDestroy filtering service, reinforcing the view that it is being used for malicious purposes. VirusTotal has recorded scans from 91 antivirus engines; at the time of analysis none of the engines flagged the domain, a result that does not constitute a safety assurance. No public SSL certificate details, HTTP response codes, or page title information have been published, limiting the ability to assess the surface‑level characteristics of the hosted content.

Given the absence of additional contextual data, defenders should treat the domain as high‑risk: network traffic to and from 5.57.226.202 should be prohibited, DNS queries for ingresaahoramx.webcindario.com should be denied or redirected, and the domain should be added to internal blocklists and threat‑intel feeds. Continuous monitoring of the IP address for changes in hosting or new associated domains is recommended, as is periodic re‑scanning with multi‑vendor services to capture any future detections.