ingreso-servicio[.]webcindario[.]com

This domain, ingreso-servicio.webcindario.com, is actively impersonating Microsoft as part of a credential-harvesting phishing campaign. Analysis indicates the site presents a login page titled 'Iniciar sesión en tu cuenta Microsoft,' directly targeting Spanish-speaking users of Microsoft services. The domain resolves to IP 5.57.226.202, hosted on AS29119 (AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL) in Spain, and is registered through Tucows Domains Inc. with nameservers under Google Domains (ns-cloud-d1.googledomains.com and related). The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious infrastructure. Infrastructure review shows the domain was created on February 28, 2001, though this long registration date does not preclude malicious use, as subdomains of older, legitimate platforms (such as webcindario.com) are frequently abused for phishing. Detection data from security vendors confirms active malicious classification: 18 of 95 engines flag the domain, and it appears on two security blocklists, including PhishDestroy and PhishingDB. A Gridinsoft trust score of 0/100 further supports its high-risk status. The site returns an HTTP 200 status, indicating it is operational and accessible. Technologies detected on the domain include Nginx, Google Tag Manager, and Google Analytics, which may be used for traffic monitoring or behavioral tracking. Defenders should note that while the domain is hosted on a subdomain of webcindario.com—a free web hosting service—this does not imply legitimacy, as such platforms are routinely exploited for phishing due to their low barriers to entry and shared infrastructure. Given the confirmed impersonation of Microsoft, the active status, and the detection metrics, this domain should be prioritized for blocking at the network and endpoint levels.