# PhishDestroy domain threat record: embramedica.com.br

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/embramedica.com.br/
Machine-readable companion: https://phishdestroy.io/domain/embramedica.com.br/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-08 00:00:42 UTC
- Last availability or vendor check: 2026-10-23 10:49:41 UTC
- Stored record updated: 2026-10-23 18:21:17 UTC
- VirusTotal detections in the stored snapshot: 9/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 186.209.113.149
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date (registry RDAP, embramedica.com.br): 2016-11-09 19:13:17 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a118d2-3683-725e-b317-c01f0f6de516/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/embramedica.com.br
- Certificate Transparency search: https://crt.sh/?q=%25.embramedica.com.br
- Web Archive lookup: https://web.archive.org/web/*/https://embramedica.com.br/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
embramedica.com.br presents itself as EMBRAMÉDICA – PRODUTOS DE LABORATÓRIOS LTDA, a Brazilian supplier of laboratory products. PhishDestroy classifies it as an impersonation phishing page aimed at people who expect to deal with that company, such as clinics, labs, buyers and procurement staff. We first flagged it on 2026-10-08. As of 2026-10-19 the site was still online and serving its content.

How the scam works
Supplier impersonation relies on trust in a familiar company name. A page branded as a lab-products distributor is a convincing setting for fake quotes, order confirmations or invoices. It can also host a login or contact form that collects business details. Victims typically lose money paid for goods that never arrive or sent to the wrong account. They can also lose credentials and company information that are later reused for invoice fraud against them or their partners.

Evidence
On 2026-10-08, VirusTotal showed 9 of 92 security engines flagging the domain. They include alphaMountain.ai, Dr.Web, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky, SafeToOpen and Sophos. That is a minority of engines, but the vendors are independent of each other and include several major ones. The domain also appears in 33 AlienVault OTX threat pulses, so other analysts have been tracking it as well. Among blocklists, only PhishDestroy currently lists it.

Infrastructure
The domain was registered on 2016-11-09, nearly ten years before PhishDestroy first saw it. That is far older than the throwaway domains common in phishing, and the age alone can make the site look legitimate to visitors and to reputation filters. It resolves to 186.209.113.149 on the EVEO S.A. network in Brazil, which matches the Brazilian audience the page addresses.

What to do
If you received a quote, invoice or bank details through this site, do not pay. Contact Embramédica only through a phone number or address you already trust, and confirm the details there. If you already paid, call your bank immediately to try to stop or recall the transfer, then file a police report. If you entered a password or business email on the page, change it everywhere it is reused, turn on two-factor authentication, and watch for follow-up messages that mention your order. Security and procurement teams should block the domain, search mail and proxy logs for contact with it, and warn finance staff about invoices or payment changes that reference it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a118d2-3683-725e-b317-c01f0f6de516/
VirusTotal report: https://www.virustotal.com/gui/domain/embramedica.com.br
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=embramedica.com.br
Archived copy: https://web.archive.org/web/20261009130849/https://embramedica.com.br/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:29:02 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a118d2-3683-725e-b317-c01f0f6de516.png
  Captured: 2026-10-08 00:05:13 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a118d2-3683-725e-b317-c01f0f6de516.png
  Captured: 2026-10-08 00:05:13 UTC
  Source report: https://urlscan.io/result/01a118d2-3683-725e-b317-c01f0f6de516/
- URLScan capture 2: https://urlscan.io/screenshots/019f6764-ef52-7189-b109-bc9e486c6c02.png
  Captured: 2026-10-08 00:00:42 UTC
  Source report: https://urlscan.io/result/01a118d2-3683-725e-b317-c01f0f6de516/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/15cac97a-b3dc-45e3-bad6-8f7c9b97fce9.png
  Captured: 2026-10-08 00:04:25 UTC
  Source report: https://radar.cloudflare.com/scan/15cac97a-b3dc-45e3-bad6-8f7c9b97fce9
  SHA-256: afe85ca5c607804ca4a8874906886787afd4a41fedc138b5a65b6792bbb7879c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:41:06Z",
        "uuid": "01a118d2-3683-725e-b317-c01f0f6de516",
        "scanned_at": "2026-10-08T00:03:23Z",
        "final_url": "https://embramedica.com.br/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://embramedica.com.br/",
                "from": "http://embramedica.com.br/",
                "status": 307
            }
        ],
        "ip": "186.209.113.149",
        "ptr": "br57-da.valueserver.net.br",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "142.251.20.95",
            "186.209.113.149"
        ],
        "asns": [
            "15169",
            "53107"
        ],
        "countries": [
            "US",
            "BR"
        ],
        "link_domains": [
            "detalharweb.com.br"
        ],
        "doc_hash": "6d7df0c710a6a834ec4c5e4bbbc18c2f805a3fb599b7a876644ab79dc2cfa775",
        "script_hashes": [
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "d151f8c0b2659cfb63704d68654ad8d9437ae9da4410536f63ddec21689a0620",
            "92b4feff9bb6c863075d35cd38d989cc254f99489f574338def1949904027d42",
            "1533d5bc82424a9a3ac37a7fe543925909d25715d16938b9e02c728c86fd86e8",
            "8c0b5e384ae00c512f4bb1ba5e2fe622fab4bfc541c99555df38c19c329d3fe6",
            "d2da9c717c6544d3681599d64e4d2d7a015b92abd6159f086b6c36df8d82d56d",
            "f25e5ba6d1bebbd94a7dcaecb99dbdfa7566f53c75f7a46cbea21221fcaf84ba",
            "ca6ef142765010507ac8c344ee29295e28bf2b93a06c536f14fdd91deff6a697",
            "50b9b0f5f712db98a09b0eea971035cd3fc52c526abdea65175ad3c78a1a49b8"
        ],
        "globals": [
            "jQuery",
            "wc_add_to_cart_params",
            "woocommerce_params",
            "_N2",
            "sbjs",
            "wc_order_attribution",
            "React",
            "ReactJSXRuntime",
            "wp",
            "ReactDOM",
            "Mousetrap",
            "lodash",
            "wc",
            "wcSettings",
            "moment",
            "__wpStyleRuntime",
            "wcBlocksMiddlewareConfig",
            "aws_vars",
            "AwsHooks",
            "elementskit",
            "n2Slow",
            "NextendThrottle",
            "NextendDeBounce",
            "n2const",
            "n2ss",
            "joinchat_obj",
            "webpackChunkelementor",
            "elementorModules",
            "Waypoint",
            "elementorFrontendConfig",
            "elementorFrontend",
            "jkit_ajax_url",
            "jkit_nonce",
            "Sweetalert2",
            "SweetAlert",
            "Swal",
            "sweetAlert",
            "swal",
            "EvEmitter",
            "imagesLoaded"
        ],
        "cookies": [
            "sbjs_migrations",
            "sbjs_current_add",
            "sbjs_first_add",
            "sbjs_current",
            "sbjs_first",
            "sbjs_udata",
            "sbjs_session"
        ],
        "storage_keys": [
            "__wpDataTestLocalStorage",
            "storeApiNonce",
            "elementor",
            "test",
            "joinchat_views",
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "embramedica.com.br",
                "ftp.embramedica.com.br",
                "mail.embramedica.com.br",
                "pop.embramedica.com.br",
                "smtp.embramedica.com.br",
                "webmail.embramedica.com.br",
                "www.embramedica.com.br"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "embramedica.com.br",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-03T19:47:21Z",
            "valid_from": "2026-09-04T19:47:22Z"
        },
        "domain_age_days": 3572,
        "apex_age_days": 3572,
        "tls_age_days": 33,
        "tls_valid_days": 89,
        "requests": 160,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -58,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:49:32Z",
        "uuid": "15cac97a-b3dc-45e3-bad6-8f7c9b97fce9",
        "scanned_at": "2026-10-08T00:04:25Z",
        "final_url": "https://embramedica.com.br/",
        "status": 200,
        "history": [
            {
                "url": "https://embramedica.com.br/",
                "status": 200
            }
        ],
        "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331",
        "doc_hash": "366231acc4255b7e8e122fcab1a02135e642d71400ad95784a370d6e74980099",
        "domain_risks": [
            "Health & Fitness",
            "Health"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "embramedica.com.br",
                "type": "A",
                "value": "186.209.113.149"
            }
        ],
        "dnssec_valid": false,
        "ip": "186.209.113.149"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T07:31:52Z",
        "analysis_at": "2026-10-21T06:58:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 10,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "Dr.Web": "malicious",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "malware",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "SafeToOpen": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "Dr.Web": "known infection source",
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "BitDefender": "onlineshop",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "compromised websites"
        },
        "popularity": {
            "Alexa": 114249,
            "Cisco Umbrella": 987141,
            "Cloudflare Radar": 1000000
        },
        "expires": "2026-11-09T00:00:00Z",
        "first_seen": "2023-10-05T12:48:36Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "root.187-45-176-194.cprapid.com",
                "value": "ns1.foxcreative.com.br"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.foxcreative.com.br"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "186.209.113.149"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.foxcreative.com.br"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 a mx ip4:186.209.113.149 include:relay.mailbaby.net ~all"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "embramedica.com.br",
                "priority": 0
            }
        ],
        "dns_at": "2026-10-21T06:58:39Z",
        "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a",
        "cert": {
            "san": [
                "embramedica.com.br",
                "ftp.embramedica.com.br",
                "mail.embramedica.com.br",
                "pop.embramedica.com.br",
                "smtp.embramedica.com.br",
                "webmail.embramedica.com.br",
                "www.embramedica.com.br"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "659f961fe08ce2bfcfd8b33d6fc62a7bd16",
            "sha256": "af0a39984c1b477ff65d4f4858b430b50d6644f069ebab79c8485536ad859bc3",
            "subject": "embramedica.com.br",
            "valid_to": "2026-12-03T19:47:21Z",
            "valid_from": "2026-09-04T19:47:22Z"
        }
    }
}
```