advance24horas[.]com[.]br

PhishDestroy identifies advance24horas.com.br as a recently activated Brazilian domain hosting a generic crypto drainer kit, designed to deceive users into connecting wallets and approving malicious transactions.

This domain, registered through Let's Encrypt for SSL encryption, was created on July 12, 2024, resolving to IP 64.31.40.182. Security vendor scans reveal an 8/95 detection rate on VirusTotal, while the domain remains absent from Google Safe Browsing’s blocklist at the time of writing.

Currently active with an elevated risk classification, advance24horas.com.br has not yet been universally blocked across enterprise or consumer security platforms. Immediate containment measures include DNS sinkholing for known resolvers and IP-based blocking. Users are strongly advised to avoid connecting wallets to unknown domains and verify any suspicious sites using PhishDestroy. Despite these countermeasures, residual risk persists due to the domain’s recent registration and low initial detection rate, underscoring the need for continuous monitoring.