portalsegurity26[.]webcindario[.]com

This domain, portalsegurity26.webcindario.com, was registered on 2026-03-03 through Tucows Domains Inc. and remains active as of the report date. The registration is recent, and the domain is hosted on the free sub‑hosting service webcindario.com, which is commonly abused for credential‑stealing pages. The domain resolves to the IPv4 address 5.57.226.202, which belongs to AS29119 AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL located in Spain. The authoritative name servers are ns‑cloud‑d1.googledomains.com, ns‑cloud‑d2.googledomains.com, and ns‑cloud‑d3.googledomains.com, indicating use of Google Cloud DNS infrastructure.

The web server identified on the host is Nginx, and the site serves a valid Let’s Encrypt certificate (R13) over HTTPS. Page loads return HTTP 200, and embedded tracking tags reveal Google Tag Manager and Google Analytics, which are typical of sites that seek to mimic legitimate portals. The low Gridinsoft trust score of 0 out of 100 further underscores the malicious nature of the host.

VirusTotal reports that 12 out of 95 scanned security vendors flag the domain as malicious, and the domain appears on at least one public blocklist. PhishDestroy has already added the domain to its blocklist, and the overall risk rating is classified as high. These signals collectively indicate that the domain is being used for generic phishing campaigns designed to harvest user credentials.

Content served by the site has not been captured in the available intelligence, so the exact lure and targeted brand cannot be confirmed. Defenders should therefore treat any traffic to this domain as hostile. Recommended actions include adding the domain and its resolving IP address to network‑level deny lists, updating email and web filtering rules to block the host, and monitoring for any related DNS queries. Continuous re‑assessment is advised, as the operators may shift hosting or alter the payload in future iterations.