# PhishDestroy domain threat record: elmaintranet.com.br

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/elmaintranet.com.br/
Machine-readable companion: https://phishdestroy.io/domain/elmaintranet.com.br/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-25 13:04:45 UTC
- Last availability or vendor check: 2026-10-22 10:27:54 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 12/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: adobe

## Stored infrastructure

- Observed IP address: 162.240.96.103
- Registrar in stored WHOIS data: NEWFOLD
- Last stored HTTP status: 200
- Registration date (registry RDAP, elmaintranet.com.br): 2026-09-20 12:28:19 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d8aa-17d8-725c-b914-a0b53ad5f806/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/elmaintranet.com.br
- Certificate Transparency search: https://crt.sh/?q=%25.elmaintranet.com.br
- Web Archive lookup: https://web.archive.org/web/*/https://elmaintranet.com.br/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
elmaintranet.com.br is a phishing page that impersonates Adobe on a Brazilian .com.br domain. Its targets are employees and business users who expect an Adobe sign-in prompt. PhishDestroy first saw it on 2026-09-25. As of 2026-10-19 the site was still online and serving its content. The page title reads "ELMA Intranet | Gestão interna inteligente", a generic Portuguese intranet label, while scanners identify Adobe branding on the page.

How the scam works
Adobe-themed phishing usually poses as a shared document or a file waiting behind an Adobe login. The visitor is asked to sign in to view it, and the email and password typed into that form go straight to the operators. A corporate-intranet name like "ELMA Intranet" makes the request look like an internal company system, which can lower a target's guard. Stolen credentials are often tried against the victim's email and other business accounts, so one entry can expose far more than an Adobe profile.

Evidence
On 2026-10-02, 12 of 91 VirusTotal engines flagged the domain, including Google Safe Browsing, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, Abusix, Gridinsoft, LevelBlue and MalwareURL. Google Safe Browsing matters most here, because browsers that rely on it will warn visitors. urlscan.io returned a malicious verdict and detected the Adobe brand on the page. Spamhaus lists the domain in its DBL under the phishing category, and the domain appears in five AlienVault OTX threat pulses.

Infrastructure
The domain was registered on 2026-09-20 through NEWFOLD and was caught within five days. That short gap is typical of throwaway phishing domains set up for a single campaign. It is hosted on Unified Layer's network in the United States, at 162.240.96.103. A free, automatically issued Let's Encrypt certificate gives it a padlock in the browser, which says nothing about whether the site is legitimate.

What to do
If you entered credentials on this page, change your Adobe password right away. Change it on every other account where you reused it, starting with your email. Turn on two-factor authentication and review recent sign-in activity and active sessions for access you don't recognise. If this was a work account, tell your IT or security team so they can reset access and watch for misuse. Defenders should block the domain and its IP, search mail and proxy logs for users who reached it, and report the page to Adobe and to the hosting provider.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d8aa-17d8-725c-b914-a0b53ad5f806/
VirusTotal report: https://www.virustotal.com/gui/domain/elmaintranet.com.br
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=elmaintranet.com.br
Archived copy: https://web.archive.org/web/20260921094125/https://elmaintranet.com.br/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:23 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/C56nqz9P/0d7d98b6f640.png
  Captured: 2026-09-25 13:04:45 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0d8aa-17d8-725c-b914-a0b53ad5f806.png
  Captured: 2026-09-25 13:04:45 UTC
  Source report: https://urlscan.io/result/01a0d8aa-17d8-725c-b914-a0b53ad5f806/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/680bd455-677e-400d-ab0d-c499c065b669.png
  Captured: 2026-09-25 13:36:54 UTC
  Source report: https://radar.cloudflare.com/scan/680bd455-677e-400d-ab0d-c499c065b669
  SHA-256: 8c41751da255bc1c83cb07dec1d8e8c9a9527cab04732eb476b358c22dbb39a0
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d8a7-4a0e-7766-8f32-37286f7f13b9.png
  Captured: 2026-09-25 13:00:45 UTC
  Source report: https://urlscan.io/result/01a0d8a7-4a0e-7766-8f32-37286f7f13b9/
  SHA-256: b554a04c1acd2723ab0f16b9fdd56c35540805ec60754812c3a788d267fd90f8
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0de65-9a3f-710a-905c-ae434bd113e3.png
  Captured: 2026-09-26 15:46:45 UTC
  Source report: https://urlscan.io/result/01a0de65-9a3f-710a-905c-ae434bd113e3/
  SHA-256: b554a04c1acd2723ab0f16b9fdd56c35540805ec60754812c3a788d267fd90f8
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f199-48ef-7158-9393-4c5af4375ab6.png
  Captured: 2026-09-30 09:15:57 UTC
  Source report: https://urlscan.io/result/01a0f199-48ef-7158-9393-4c5af4375ab6/
  SHA-256: b554a04c1acd2723ab0f16b9fdd56c35540805ec60754812c3a788d267fd90f8

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:57:43Z",
        "uuid": "01a0d8aa-17d8-725c-b914-a0b53ad5f806",
        "scanned_at": "2026-09-25T13:03:47Z",
        "final_url": "https://elmaintranet.com.br/build/assets/login.php",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://elmaintranet.com.br/build/assets/login.php",
                "from": "http://elmaintranet.com.br/build/assets/login.php",
                "status": 307
            }
        ],
        "ip": "162.240.96.103",
        "ptr": "vps-12855344.malcher.site",
        "domains": [
            "maxcdn.bootstrapcdn.com",
            "code.jquery.com",
            "cdnjs.cloudflare.com",
            "kit.fontawesome.com",
            "fonts.googleapis.com",
            "ajax.googleapis.com",
            "storage.googleapis.com"
        ],
        "ips": [
            "104.17.24.14",
            "2a06:98c1:310c::ac40:93bc",
            "2a00:1450:4001:c0f::5f",
            "104.18.10.207",
            "2a04:4e42::411",
            "2a00:1450:4001:c1f::5f",
            "162.240.96.103"
        ],
        "asns": [
            "13335",
            "15169",
            "54113",
            "46606"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "d7dfc8002407dba9acded062fb327ad123af56d83832f1b348e715dd29bd14cf",
        "globals": [
            "requestResize",
            "$",
            "jQuery",
            "Popper",
            "bootstrap"
        ],
        "tls": {
            "san": [
                "*.elmaintranet.com.br",
                "elmaintranet.com.br"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "elmaintranet.com.br",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-19T11:46:45Z",
            "valid_from": "2026-09-20T11:46:46Z"
        },
        "domain_age_days": 5,
        "apex_age_days": 5,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 14,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "adobe"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Adobe"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:05:42Z",
        "uuid": "680bd455-677e-400d-ab0d-c499c065b669",
        "scanned_at": "2026-09-25T13:36:54Z",
        "final_url": "https://elmaintranet.com.br/",
        "status": 200,
        "history": [
            {
                "url": "https://elmaintranet.com.br/",
                "status": 200
            }
        ],
        "dom_hash": "6e18c8b59d2a938631e046e08f29c85e1fd085bf59e94316417fb4c0897180c2",
        "doc_hash": "944dfbce80141a0e177f92d56d59b09098af478e536f0ee2aa4838b9aba602a2",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "elmaintranet.com.br",
                "type": "A",
                "value": "162.240.96.103"
            }
        ],
        "dnssec_valid": false,
        "ip": "162.240.96.103",
        "whois": {
            "created": "2026-09-20T00:00:00Z",
            "updated": "2026-09-20T00:00:00Z",
            "expires": "2028-09-20T00:00:00Z",
            "nameservers": [
                "ns1.elmaconecta.com.br",
                "ns2.elmaconecta.com.br"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:08:25Z",
        "analysis_at": "2026-10-12T09:19:30Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 7,
            "suspicious": 2,
            "undetected": 31
        },
        "detections": {
            "VIPRE": "phishing",
            "Emsisoft": "malware",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Gridinsoft": "suspicious",
            "MalwareURL": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "created": "2026-09-20T00:00:00Z",
        "first_seen": "2026-09-20T13:00:47Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.vps-12855344.malcher.site",
                "value": "ns1.elmaconecta.com.br"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.elmaconecta.com.br"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "162.240.96.103"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.elmaconecta.com.br"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "mail.elmaintranet.com.br",
                "priority": 0
            }
        ],
        "dns_at": "2026-10-12T09:19:46Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "*.elmaintranet.com.br",
                "elmaintranet.com.br"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5f1057f006fdd4b28e52cf0e58d7bbd540e",
            "sha256": "6570c06d34f174ad67b2911682ba69af47d33054183875a39b1bfeb2a0155373",
            "subject": "elmaintranet.com.br",
            "valid_to": "2026-12-19T11:46:45Z",
            "valid_from": "2026-09-20T11:46:46Z"
        },
        "whois": []
    }
}
```