pc[.]drwinxgiobal[.]cc

This domain, pc.drwinxgiobal.cc, operates as a brand impersonation site targeting Microsoft users. Attackers designed it to mimic legitimate Microsoft login pages, tricking visitors into entering account credentials. The page title, "CMC Markets," suggests an attempt to mislead users further by presenting unrelated financial branding, potentially increasing the likelihood of successful credential theft or financial fraud. The domain poses a high risk due to its deceptive design and direct targeting of sensitive user data. Analysis indicates the domain was registered on May 7, 2025, through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3. It appears on three security blocklists and is flagged by 15 out of 95 security vendors on VirusTotal, confirming its malicious nature. The domain currently holds a trust score of 0/100, reflecting its lack of legitimacy and association with known threat infrastructure. Its inclusion in blocklists by multiple independent security providers further validates its classification as a high-risk entity. If you visited pc.drwinxgiobal.cc or entered credentials on the site, immediately reset passwords for any accounts accessed from the same device. Enable multi-factor authentication (MFA) on all critical accounts, particularly those linked to Microsoft services. Scan the device for malware using updated security tools, as the domain may have been part of a broader attack chain. Monitor financial and account activity for unauthorized transactions or changes, and report any suspicious incidents to relevant security teams or platforms.