# PhishDestroy domain threat record: portaldigital-br.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/portaldigital-br.com/
Machine-readable companion: https://phishdestroy.io/domain/portaldigital-br.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 03:47:56 UTC
- Last availability or vendor check: 2026-10-27 23:55:20 UTC
- Stored record updated: 2026-10-27 23:55:20 UTC
- VirusTotal detections in the stored snapshot: 13/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: govbr

## Stored infrastructure

- Observed IP address: 191.101.184.24
- Registrar in stored WHOIS data: Dominet (HK) Limited
- Registrar country in stored WHOIS data: US
- Registration date in stored WHOIS data: 2026-09-08 20:39:13 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17b77-2a72-70ec-9659-79a80b053333/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/portaldigital-br.com
- Certificate Transparency search: https://crt.sh/?q=%25.portaldigital-br.com
- Web Archive lookup: https://web.archive.org/web/*/https://portaldigital-br.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake system flagged the domain on 2026-10-27 after a fresh URLScan scan returned a malicious verdict and an AI model assigned a high phishing confidence. The prior assessment noted that the page mimics the Brazilian government’s gov.br login, presenting a form that asks for a CPF number. An HTTP 200 response was recorded on the same date, while the page title later captured showed “404 - Página Não Encontrada,” indicating the visible content differed from the phishing excerpt.

How the scam works
In this credential‑phishing variant, attackers host a replica of the official gov.br login page and solicit the user’s CPF and password, which can be harvested for unauthorized access to government services. Victims are typically lured via malicious links or email, believing the page is authentic.

Evidence
VirusTotal recorded 13 detections across 92 engines on 2026-10-27, classifying the domain as malicious (10) and suspicious (3). URLScan’s analysis on 2026-10-27 gave a malicious verdict with a score of 100, categorising it as phishing and linking it to the gov.br brand. Google Safe Browsing reported no warning as of 2026-10-27. The domain appears on the OpenPhish blocklist and is internally listed by PhishDestroy, both checked on 2026-10-27. OTX listed three pulses referencing the domain as of 2026-10-27.

Infrastructure
The domain was registered on 2026-09-08 through Dominet (HK) Limited, giving it an age of 48 days at the time of observation. DNS records captured on 2026-10-27 listed the A addresses 191.101.184.76 and 191.101.184.24, which belonged to ASNs 13335 and 199058. A Let’s Encrypt certificate for the domain was observed with a validity period from 2026-10-25 to 2027-01-23.

What to do
Anyone who may have entered credentials on this site should change their gov.br password via the official portal and review account activity. Organizations should block the domain and its IPs at the network perimeter and monitor logs for connections to the recorded addresses. Security teams can reference the VirusTotal and URLScan reports for further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17b77-2a72-70ec-9659-79a80b053333/
Cloudflare Radar report: https://radar.cloudflare.com/scan/33a76e2b-f646-4f95-8c5f-9557531cfa82
URLQuery report: https://urlquery.net/report/44cdcd4b-ea60-437d-bb46-d8013ce6cfb0
Stored capture screenshot: https://i.ibb.co/qMXsTkND/2cf263c17ee3.png
Cloudflare Radar screenshot (2026-10-27T04:19:07Z): https://screenshots.phishdestroy.io/cf/33a76e2b-f646-4f95-8c5f-9557531cfa82.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/44cdcd4b-ea60-437d-bb46-d8013ce6cfb0.png
URLScan screenshot (2026-09-17T01:18:30Z): https://screenshots.phishdestroy.io/us/01a0acf1-7367-7315-a12a-ff9ccd9a4126.png
URLScan capture report: https://urlscan.io/result/01a0acf1-7367-7315-a12a-ff9ccd9a4126/
URLScan screenshot (2026-10-27T01:01:53Z): https://screenshots.phishdestroy.io/us/01a17ae0-9478-75d6-aef2-17aea70af344.png
URLScan capture report: https://urlscan.io/result/01a17ae0-9478-75d6-aef2-17aea70af344/
VirusTotal report: https://www.virustotal.com/gui/domain/portaldigital-br.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=portaldigital-br.com
Archived copy: https://web.archive.org/web/20261027034722/https://portaldigital-br.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 04:21:23 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qMXsTkND/2cf263c17ee3.png
  Captured: 2026-10-27 03:47:56 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17b77-2a72-70ec-9659-79a80b053333.png
  Captured: 2026-10-27 03:47:56 UTC
  Source report: https://urlscan.io/result/01a17b77-2a72-70ec-9659-79a80b053333/
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17ae0-9478-75d6-aef2-17aea70af344.png
  Captured: 2026-10-27 01:01:53 UTC
  Source report: https://urlscan.io/result/01a17ae0-9478-75d6-aef2-17aea70af344/
  SHA-256: 05f485f88a6d204fe0fc5fb188114acfdf609ce1b10a087a6a52eb8748c7f491
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0acf1-7367-7315-a12a-ff9ccd9a4126.png
  Captured: 2026-09-17 01:18:30 UTC
  Source report: https://urlscan.io/result/01a0acf1-7367-7315-a12a-ff9ccd9a4126/
  SHA-256: 3c088f2b56f4d19a13d9ce4735cb1e6e0176cf1f46744647089ee5a9e309408e
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/33a76e2b-f646-4f95-8c5f-9557531cfa82.png
  Captured: 2026-10-27 04:19:07 UTC
  Source report: https://radar.cloudflare.com/scan/33a76e2b-f646-4f95-8c5f-9557531cfa82
  SHA-256: eb7f82c62398f6e6d449f87fc2ca44c4c288c3f78c307f6f6946c4f3c92f3f15
- URLQuery: https://screenshots.phishdestroy.io/uq/44cdcd4b-ea60-437d-bb46-d8013ce6cfb0.png
  Source report: https://urlquery.net/report/44cdcd4b-ea60-437d-bb46-d8013ce6cfb0
  SHA-256: f90d0511d86e2a186565b02ee5c5bd32181242737f7f1ae5115921a8084f8436

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T04:04:09Z",
        "uuid": "01a17b77-2a72-70ec-9659-79a80b053333",
        "scanned_at": "2026-10-27T03:46:16Z",
        "final_url": "https://portaldigital-br.com/login/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://portaldigital-br.com/login",
                "from": "http://portaldigital-br.com/login",
                "status": 307
            },
            {
                "to": "http://portaldigital-br.com/login/",
                "from": "https://portaldigital-br.com/login",
                "status": 301
            },
            {
                "to": "https://portaldigital-br.com/login/",
                "from": "http://portaldigital-br.com/login/",
                "status": 307
            }
        ],
        "ip": "191.101.184.76",
        "domains": [
            "fonts.cdnfonts.com",
            "cdn.jsdelivr.net",
            "cdn.lineicons.com"
        ],
        "ips": [
            "104.21.72.124",
            "104.17.208.5",
            "191.101.184.76"
        ],
        "asns": [
            "13335",
            "199058"
        ],
        "countries": [
            "PL"
        ],
        "cookies": [
            "hydra_visita"
        ],
        "domain_age_days": 48,
        "apex_age_days": 48,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 24,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "govbr"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Government of Brasil"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T04:20:42Z",
        "uuid": "33a76e2b-f646-4f95-8c5f-9557531cfa82",
        "scanned_at": "2026-10-27T04:19:07Z",
        "final_url": "https://portaldigital-br.com/",
        "status": 200,
        "history": [
            {
                "url": "https://portaldigital-br.com/",
                "status": 200
            }
        ],
        "dom_hash": "e02456b3efe4c14679be85b68db4eb2d514555859de1237a9bfeabdada344ad5",
        "doc_hash": "5f1317c5834e5d18ad541135e6d137d149767a977497c3a521d2070fee8f13e5",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "portaldigital-br.com",
                "type": "A",
                "value": "191.101.184.76"
            },
            {
                "name": "portaldigital-br.com",
                "type": "A",
                "value": "191.101.184.24"
            }
        ],
        "dnssec_valid": false,
        "ip": "191.101.184.76",
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-09-08T22:39:13Z",
            "updated": "2026-10-25T03:14:24Z",
            "expires": "2027-09-08T22:39:13Z",
            "nameservers": [
                "ns1.hydrahost.com.br",
                "ns2.hydrahost.com.br"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T04:18:58Z",
        "analysis_at": "2026-10-27T03:09:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 10,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "malware",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "Kaspersky": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "spyware and malware",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "Dominet (HK) Limited",
        "created": "2026-09-08T22:39:13Z",
        "expires": "2027-09-08T22:39:13Z",
        "updated": "2026-09-08T22:56:57Z",
        "first_seen": "2026-09-09T00:54:10Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.hydrahost.com.br"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "suporte.hydrahost.com.br",
                "value": "ns1.hydrahost.com.br"
            },
            {
                "ttl": 30,
                "type": "A",
                "value": "191.101.184.24"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.hydrahost.com.br"
            },
            {
                "ttl": 30,
                "type": "A",
                "value": "191.101.184.76"
            }
        ],
        "dns_at": "2026-10-27T03:09:30Z",
        "jarm": "28d28d28d00028d00042d42d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "portaldigital-br.com",
                "www.portaldigital-br.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "508d96eebe4a8191c3bd0d9ca05c40ce424",
            "sha256": "8309cee6cd3593a8586feecc2a46b38e69fcd50797bc50c1f79c0b80c5c083cd",
            "subject": "portaldigital-br.com",
            "valid_to": "2027-01-23T02:20:56Z",
            "valid_from": "2026-10-25T02:20:57Z"
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "registrar_iana_id": "3775",
            "registrar_url": "http://www.alibabacloud.com",
            "created": "2026-09-08T22:39:13Z",
            "updated": "2026-09-08T22:56:57Z",
            "expires": "2027-09-08T22:39:13Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-08T22:39:13Z",
                "registration": "2026-09-08T22:39:13Z",
                "registrar expiration": "2027-09-08T22:39:13Z",
                "last update of RDAP database": "2026-09-08T22:39:14Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T04:20:53Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "portaldigital-br.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-27T03:47:22Z",
            "first": "2026-10-27T03:47:22Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1430
        },
        "social_tags": {
            "title": "404 - Página Não Encontrada"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 88,
                "tls": 61,
                "wait": 134,
                "connect": 38,
                "download": 0
            },
            "response_ms": 321
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 2577,
            "co2_grams": 0.0001,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "68.183.63.61",
                    "host": "ns1.hydrahost.com.br"
                },
                {
                    "ip": "161.35.95.47",
                    "host": "ns2.hydrahost.com.br"
                }
            ],
            "zone": "portaldigital-br.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "hydra_visita",
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "191.101.184.24",
            "asn": "199058",
            "org": "Serva ONE LTD",
            "city": "Gdansk",
            "country": "PL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "portaldigital-br.com"
        },
        "dns": {
            "A": [
                "191.101.184.24",
                "191.101.184.76"
            ],
            "NS": [
                "ns2.hydrahost.com.br",
                "ns1.hydrahost.com.br"
            ],
            "SOA": "{\"nsname\": \"ns1.hydrahost.com.br\", \"hostmaster\": \"suporte.hydrahost.com.br\", \"serial\": 2026051627, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 60}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "191.101.184.76",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://portaldigital-br.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Ubuntu",
                "Nginx"
            ]
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-09-08T22:39:13Z",
            "updated": "2026-10-25T03:14:24Z",
            "expires": "2027-09-08T22:39:13Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.hydrahost.com.br",
                "ns2.hydrahost.com.br"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.24.0 (Ubuntu)",
                "content-type": "text/html"
            }
        }
    }
}
```