valida-correo365[.]webcindario[.]com

This domain, valida-correo365.webcindario.com, is actively engaged in credential phishing targeting users of Microsoft 365 services. The page title 'Iniciar' suggests a fake login portal designed to harvest account credentials, likely leveraging social engineering tactics to mimic legitimate authentication workflows. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with common phishing frameworks used to impersonate cloud-based productivity suites. The domain’s naming convention, incorporating 'correo365,' directly references Microsoft 365’s email services, increasing its likelihood of deceiving users seeking to access their accounts. Analysis indicates the domain was registered on February 28, 2001, through TUCOWS.COM, CO., and currently resolves to the IP address 5.57.226.202, hosted on AS29119 (AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL) in Spain. The SSL certificate is issued by Let’s Encrypt (R12), providing a superficial layer of legitimacy. Google Safe Browsing has flagged the domain as phishing, and it appears on at least one security blocklist. VirusTotal reports 16 out of 95 security vendors detecting the domain as malicious, with detections spanning generic phishing and credential theft categories. The domain remains active as of the latest verification, posing a continued risk to users who may encounter it through phishing emails, malicious redirects, or compromised advertisements. Response actions should include immediate blocking of the domain and its associated IP address at the network level, alongside user education to recognize phishing indicators such as suspicious URLs and unsolicited login prompts. Despite its long registration history, the domain’s current use for phishing underscores the need for ongoing monitoring and proactive mitigation to prevent credential compromise and subsequent unauthorized access to corporate or personal accounts.