userbhd2026[.]webcindario[.]com

The domain userbhd2026.webcindario.com was registered on February 21, 2026 via Tucows Domains Inc. It resolves to the IPv4 address 5.57.226.202, which is geolocated to Spain and associated with AS29119 AIRE NETWORKS DEL MEDITERRANEO SL UNIPERSONAL. The site is served over HTTPS using a Let’s Encrypt R13 certificate and returns HTTP 200 responses. Infrastructure analysis shows the web server runs Nginx and includes Google Tag Manager and Google Analytics scripts, indicating standard tracking capabilities. Google Safe Browsing has listed the domain under the SOCIAL_ENGINEERING category, and PhishDestroy has already added it to its blocklist. VirusTotal scans report 15 of 95 security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one additional security blocklist, reinforcing its elevated risk profile. Publicly available content has not been examined, so the exact phishing lure, credential collection mechanism, or targeted brand cannot be confirmed at this time. The presence of tracking tags suggests a potential intent to harvest visitor data, but without page snapshots the specific social engineering narrative remains unknown. No additional kit or malware identifiers have been observed in the current metadata. Defenders should immediately block or sinkhole userbhd2026.webcindario.com at network perimeter and DNS layers, and add the associated IP address 5.57.226.202 to host‑based deny lists. Continuous monitoring of outbound connections to the domain and its hosting infrastructure is advised, as well as periodic re‑scans on VirusTotal for any changes in detection ratios. Organizations using web filtering should ensure the domain is present in updated phishing block lists, and incident response teams should treat any credential submissions to this site as compromised.