sisedi[.]com[.]br

Analysis indicates that the domain sisedi.com.br remains active and is presently blocked by the PhishDestroy sinkhole, suggesting it is being used for credential harvesting. The domain was registered on June 29, 2021 and continues to resolve to the IP address 34.196.85.128, which is hosted on Cloudflare infrastructure as evidenced by the authoritative nameservers damiete.ns.cloudflare.com and naya.ns.cloudflare.com. The domain appears on a single security blocklist, confirming that at least one external threat feed has flagged it for malicious activity.

VirusTotal reports that the domain has been scanned by 95 antivirus and URL scanning engines; while no engine returned a positive detection, the lack of detections does not constitute assurance of safety and may reflect evasion or limited coverage. No additional public evidence such as Safe Browsing verdicts, Open Threat Exchange entries, registrar details, SSL certificate metadata, HTTP response codes, trust scores, page titles, or supplemental evidence links have been disclosed, leaving those aspects of the threat profile unverified. Defenders should continue to block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP, and consider adding the domain to internal blocklists.

Ongoing verification of the hosting environment and periodic rescanning with multiple detection services are recommended to detect any future changes in payload or hosting. Incident response teams should treat any authentication attempts to services linked with sisedi.com.br as potentially compromised and enforce credential resets for affected users.