# PhishDestroy threat dossier — mercadolibre-promocao.vercel.app ================================================================ Fetched: 2026-05-14 17:14:13 UTC Canonical: https://phishdestroy.io/domain/mercadolibre-promocao.vercel.app/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_split) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 17/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, MalwareURL, Netcraft, Sophos, VIPRE, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 64.29.17.3 Registrar: Vercel Inc. Nameservers: NS_NOT_FOUND Registered: 2026-05-14 Page title: MoblyStore - Eletrodomésticos com os Melhores Preços | Ar Condicionado, Geladeira, Fogão ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-14 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-14 18:12:53 UTC (by PhishDestroy tracker) Last verified: 2026-05-14 19:40:03 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e270a-c3d0-727f-90dc-d1f7b24d7097/ Wayback Machine: https://web.archive.org/web/*/mercadolibre-promocao.vercel.app crt.sh CT logs: https://crt.sh/?q=%25.mercadolibre-promocao.vercel.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=mercadolibre-promocao.vercel.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/mercadolibre-promocao.vercel.app URLhaus: https://urlhaus.abuse.ch/host/mercadolibre-promocao.vercel.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-14 18:13:36 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies mercadolibre-promocao.vercel.app as an active brand impersonation phishing domain impersonating MercadoLibre, a major Latin American e-commerce platform. This domain leverages a spoofed promotion narrative to deceive users into entering credentials or payment details. The campaign is designed to harvest sensitive data under the guise of a legitimate platform offer, typical of credential theft operations targeting MercadoLibre customers. The infrastructure suggests a low-effort but potentially effective attempt to exploit user trust in familiar brand names. Seed 7d9415. This domain resolves to IP 64.29.17.3 and is registered through Vercel Inc., a legitimate cloud platform often abused by threat actors for phishing due to its free tier and rapid deployment capabilities. VirusTotal shows a detection ratio of 17 out of 95 security vendors with a Google Trust Services SSL certificate. While Google Safe Browsing (GSB) status is not explicitly confirmed here, the low VT count suggests limited global blocking coverage. The domain's recent creation (inferred via Vercel’s platform timeline) and lack of long-term reputation raise immediate suspicion. Additionally, the domain contains the brand name “mercadolibre,” a clear indicator of impersonation intent. As of the latest data, this domain remains active and poses an elevated risk to users engaging with MercadoLibre-branded content outside official channels. Immediate actions include blocking the domain at DNS/network level, flagging the IP and domain in SIEM systems, and increasing user awareness regarding spoofed promotions. However, due to the abuse of legitimate hosting services (Vercel), defensive measures remain partially reactive. Remaining risk includes continued circulation through phishing emails or social engineering, especially in regions where MercadoLibre is widely used. Users are advised to verify promotions directly via official MercadoLibre domains and avoid clicking unverified links. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: e445dde5c3437f3f371e558e0df0e2e0 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/mercadolibre-promocao.vercel.app/ JSON API: https://api.destroy.tools/v1/check?domain=mercadolibre-promocao.vercel.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 149,313 domains (36,954 alive under monitoring, 111,596 confirmed takedowns/dead). Site: https://phishdestroy.io