loadwincap[.]com

Analysis of the domain loadwincap.com indicates it was actively involved in a tech support scam impersonating Microsoft, specifically targeting users through a fraudulent Microsoft Office activation page. The domain, registered on January 29, 2025, via HOSTINGER operations, UAB, resolved to the IP address 185.255.122.94, hosted under AS30860 (Virtual Systems LLC) in Ukraine. The page title, 'Ativação do Microsoft Office,' suggests the scam was localized for Portuguese-speaking users, though the exact content and interaction flow remain unconfirmed due to the domain's current offline status. Infrastructure analysis reveals the domain used nameservers ns1.freednsdedi.com and ns2.freednsdedi.com, a configuration often associated with bulletproof or low-reputation hosting.

No SSL certificate was detected, increasing the likelihood of interception or man-in-the-middle risks for visitors. At the time of assessment, the domain appeared on one security blocklist and was flagged by 3 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Defenders should treat this domain as a confirmed threat vector for tech support fraud.

The IP address 185.255.122.94 and associated nameservers should be monitored for related malicious activity. Given the domain's offline status, historical DNS and WHOIS records should be preserved for forensic analysis. Organizations are advised to block both the domain and its resolved IP at the perimeter, and to alert users about the specific 'Ativação do Microsoft Office' scam variant. No evidence links this domain to broader phishing kits or campaigns, so correlation with other indicators should focus on the IP and registrar patterns.