amalba[.]com[.]br

This domain, amalba.com.br, is actively flagged as a high-risk phishing site impersonating iandbagsupply.us, as indicated by its page title and observable infrastructure. Analysis reveals the domain was registered on April 9, 2025, and currently resolves to the IP address 188.114.97.3, which is associated with Cloudflare's network (AS13335). The site returns an HTTP 200 status, suggesting an operational phishing page rather than a parked or defunct domain. It has been detected on at least one security blocklist and appears in a single threat intelligence pulse, reinforcing its classification as malicious activity targeting unsuspecting users. Infrastructure analysis indicates the domain uses Cloudflare nameservers (evangeline.ns.cloudflare.com and hunts.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The SSL certificate is issued by Google Trust Services, specifically the WE1 intermediate, which does not inherently indicate malicious intent but is consistent with phishing sites leveraging legitimate certificate authorities to appear trustworthy. While the exact phishing kit or payload remains unconfirmed, the domain's inclusion in 17 out of 95 security vendor detections on VirusTotal further corroborates its malicious nature. Defenders should treat amalba.com.br as an active threat. The domain's registration age, combined with its presence on blocklists and in threat intelligence feeds, suggests it is part of a sustained phishing campaign. Network-level blocking of the IP 188.114.97.3 and monitoring for related domains using the same nameservers or SSL certificate issuer may help mitigate further exposure. Given the domain's impersonation of iandbagsupply.us, organizations with ties to the targeted brand should prioritize user awareness and email filtering to prevent credential harvesting or financial fraud attempts.