mercadopagobr[.]top

This domain, mercadopagobr.top, is flagged as a credential harvesting phishing site designed to impersonate a legitimate payment platform. The page title, 'mercadopago Brasil: Guia de Apostas, Cassino Online e Pix,' explicitly targets users seeking financial services, including betting, online casinos, and Pix transactions, which are common vectors for stealing login credentials, payment details, and personal information. Analysis indicates the domain is structured to mimic trusted financial interfaces, increasing the likelihood of successful deception among users familiar with these services. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered through Dynadot LLC on June 11, 2026, a future date suggesting potential domain spoofing or incorrect registration data. It resolves to the IP address 188.114.96.3 and is flagged by 4 out of 95 security vendors on VirusTotal. Additionally, it appears on one security blocklist and is referenced in a single threat intelligence pulse on AlienVault OTX. The SSL certificate issued by Google Trust Services may lend a false sense of legitimacy, further complicating user detection. Users who visited mercadopagobr.top should take immediate action to mitigate potential risks. If credentials or payment details were entered, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. Financial institutions should be notified to monitor for unauthorized transactions. System scans using updated security tools are recommended to detect any malware or persistent threats. Given the domain's current offline status, users should remain vigilant for similar phishing attempts, particularly those leveraging financial or betting-related themes.