centralfinanceiroplus[.]online

This domain, centralfinanceiroplus.online, is actively engaged in credential harvesting phishing operations targeting users of financial services. Analysis indicates the site mimics legitimate banking portals to deceive visitors into submitting sensitive login credentials, including usernames, passwords, and multi-factor authentication codes. The infrastructure is designed to capture and exfiltrate this data to unauthorized third parties, leading to potential account takeovers and financial fraud. Infrastructure analysis reveals the domain was registered on June 30, 2026, through Dynadot Inc, a registrar frequently observed in phishing campaigns. It resolves to the IP address 69.49.241.129, which currently shows no detections on VirusTotal (0/95 engines). The SSL certificate is issued by Let's Encrypt, a common choice for malicious actors due to its free and automated issuance process. As of this advisory, the domain remains unblocked by major threat intelligence feeds, increasing the risk of undetected exposure. Users who have visited centralfinanceiroplus.online or entered credentials on the site should immediately revoke any submitted information. This includes changing passwords for all financial accounts, enabling multi-factor authentication where available, and monitoring accounts for unauthorized transactions. Network administrators are advised to block the domain and its associated IP (69.49.241.129) at the perimeter. If credentials were entered, affected parties should assume compromise and follow incident response protocols, including notifying their financial institution and reporting the incident to relevant cybersecurity authorities.