# PhishDestroy domain threat record: validar-memed.com.br Content language: English Canonical HTML report: https://phishdestroy.io/domain/validar-memed.com.br/ Machine-readable companion: https://phishdestroy.io/domain/validar-memed.com.br/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-09 13:34:48 UTC - Last availability or vendor check: 2026-10-22 10:38:00 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 8/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 216.198.79.1 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 308 - Registration date (registry RDAP, validar-memed.com.br): 2026-03-05 12:17:56 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a120df-c663-750e-8b49-1c640909f3c0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/validar-memed.com.br - Certificate Transparency search: https://crt.sh/?q=%25.validar-memed.com.br - Web Archive lookup: https://web.archive.org/web/*/https://validar-memed.com.br/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview validar-memed.com.br is an impersonation phishing page that borrows the Memed name and presents itself as a service for validating medical certificates. Its page title, "Validação — Atestados Médicos", aims at Brazilians who handle sick notes: patients, doctors who issue them, and HR staff who verify them. PhishDestroy first saw the domain on 2026-10-09. As of 2026-10-19 it was still online and redirecting visitors. How the scam works The page relies on the trust people place in a real healthcare platform. Its .com.br address combines "validar" with the brand name, so it looks like an official verification portal. Someone who is checking an atestado or responding to a request to "validate" a document is asked to enter information into a page that Memed does not control. Fake validation portals like this usually collect personal and identity details, professional login credentials, or patient information. Attackers can reuse that data for fraud, account takeover, or forged medical documents. Evidence On 2026-10-13, 8 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, SOCRadar and Webroot. That is a modest count, but these are major independent vendors, several of which feed browser and endpoint protection, so many users get some warning. PhishDestroy lists the domain on its own blocklist. Infrastructure The domain was registered on 2026-03-05, about seven months before PhishDestroy detected it. That gap suggests it was either held in reserve or ran quietly before drawing attention. The site is hosted on Amazon's network (AS16509) in the United States. It uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about who runs the site. What to do If you entered your CPF, contact details, or patient data on this page, watch for identity misuse and be suspicious of follow-up calls or messages claiming to be from Memed. If you used a professional or Memed password there, change it immediately wherever you have reused it, and turn on two-factor authentication. Verify medical certificates only through the official channels the issuing doctor or Memed provides, never through a link someone sent you. Security teams and Brazilian healthcare and HR organizations should block the domain and warn staff about fake "validação de atestado" pages. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a120df-c663-750e-8b49-1c640909f3c0/ VirusTotal report: https://www.virustotal.com/gui/domain/validar-memed.com.br Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=validar-memed.com.br Archived copy: https://web.archive.org/web/20261009133843/https://www.validar-memed.com.br/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:28:23 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a120df-c663-750e-8b49-1c640909f3c0.png Captured: 2026-10-09 13:36:59 UTC - URLScan capture: https://urlscan.io/screenshots/01a1177a-34d8-72fa-a337-9c38e3177fa2.png Captured: 2026-10-09 13:34:48 UTC Source report: https://urlscan.io/result/01a120df-c663-750e-8b49-1c640909f3c0/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/76d57165-ee90-4358-bcd2-bdc277ece211.png Captured: 2026-10-09 13:37:34 UTC Source report: https://radar.cloudflare.com/scan/76d57165-ee90-4358-bcd2-bdc277ece211 SHA-256: 8a4317cbfc2942f88b30ef0bc6510478a8abe976479cbfb60d7c2c4498878ef7 - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a120e2-d66c-77da-9030-f8794f5e6da4.png Captured: 2026-10-09 13:38:26 UTC Source report: https://urlscan.io/result/01a120e2-d66c-77da-9030-f8794f5e6da4/ SHA-256: 7dd91d52701281818b6b9f14ddfe18997bd13584eb6b3d73da027986de134368 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T18:36:50Z", "uuid": "01a120df-c663-750e-8b49-1c640909f3c0", "scanned_at": "2026-10-09T13:35:26Z", "final_url": "https://www.validar-memed.com.br/", "status": 200, "redirected": "parent-domain", "redirects": [ { "to": "https://validar-memed.com.br/", "from": "http://validar-memed.com.br/", "status": 307 }, { "to": "https://www.validar-memed.com.br/", "from": "https://validar-memed.com.br/", "status": 308 }, { "to": "http://validar-memed.com.br/", "from": "https://www.validar-memed.com.br/", "status": 307 }, { "to": "https://validar-memed.com.br/", "from": "http://validar-memed.com.br/", "status": 307 }, { "to": "https://www.validar-memed.com.br/", "from": "https://validar-memed.com.br/", "status": 308 } ], "ip": "216.198.79.65", "domains": [ "validar-memed.com.br" ], "ips": [ "216.198.79.65", "216.198.79.1" ], "asns": [ "16509" ], "countries": [ "US" ], "doc_hash": "414870ee0cc790998a709784a2fa4ea432db8ef0d35af27c3a2df0c67a517a71", "script_hashes": [ "ca7eddb03419541cdca9ae86c0182f57690fefd6ccd50cb8591e1056baa7f1aa", "b8bddf9481d859d648e1e050f8322eb3defe3dd3f9bd13f4c44dd6f2ecf5ab80", "7bd6f41cfe0ce8b68c0fcfc0c580bf3f21c9d7b49f22665e6b21bb5ef49b476a", "d7008163f1ed16ecb840d251190ac8a9d02132df87f25781faef1499945f9bdc", "d902b6fb9162fb4fe11e8cbb8213d62499501655d633bedff1ffff5b26fd9b5e" ], "globals": [ "__next_f", "webpackChunk_N_E", "next" ], "tls": { "san": [ "www.validar-memed.com.br" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "www.validar-memed.com.br", "protocol": "TLS 1.3", "valid_to": "2026-11-23T12:31:43Z", "valid_from": "2026-08-25T12:31:44Z" }, "domain_age_days": 217, "apex_age_days": 217, "tls_age_days": 45, "tls_valid_days": 89, "requests": 12, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 22, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Vercel", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:46:49Z", "uuid": "76d57165-ee90-4358-bcd2-bdc277ece211", "scanned_at": "2026-10-09T13:37:34Z", "final_url": "https://www.validar-memed.com.br/", "status": 200, "redirected": "subdomain", "history": [ { "url": "https://validar-memed.com.br/", "status": 308 }, { "url": "https://www.validar-memed.com.br/", "status": 200 } ], "dom_hash": "d6cb0d19b0dcb83056595f32258f746dfd584e3381be8f4d851cdc555c013b74", "doc_hash": "414870ee0cc790998a709784a2fa4ea432db8ef0d35af27c3a2df0c67a517a71", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "validar-memed.com.br", "type": "A", "value": "216.198.79.1" }, { "name": "www.validar-memed.com.br", "type": "CNAME", "value": "12bd199f5f71bc41.vercel-dns-017.com" }, { "name": "www.validar-memed.com.br", "type": "CNAME", "value": "12bd199f5f71bc41.vercel-dns-017.com" } ], "dnssec_valid": true, "ip": "216.198.79.65", "whois": { "created": "2026-03-05T00:00:00Z", "updated": "2026-03-05T00:00:00Z", "expires": "2027-03-05T00:00:00Z", "nameservers": [ "d.sec.dns.br", "f.sec.dns.br" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T04:40:14Z", "analysis_at": "2026-10-14T07:18:38Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 5, "suspicious": 1, "undetected": 36 }, "detections": { "ESET": "suspicious", "G-Data": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "created": "2026-03-05T00:00:00Z", "updated": "2026-03-05T00:00:00Z", "first_seen": "2026-03-05T18:36:46Z", "dns": [ { "ttl": 3600, "type": "NS", "value": "f.sec.dns.br" }, { "ttl": 3600, "type": "A", "value": "216.198.79.1" }, { "ttl": 3600, "type": "NS", "value": "d.sec.dns.br" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.registro.br", "value": "d.sec.dns.br" } ], "dns_at": "2026-10-14T07:18:58Z", "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "cert": { "san": [ "validar-memed.com.br" ], "issuer": "Let's Encrypt / YR1", "serial": "65fc798543242f533e77bab82c51f3b62bb", "sha256": "772e5d4a38efc7ca0f9157957dcd8d3ba9821c6c905f9435a5822d0a64d01e79", "subject": "validar-memed.com.br", "valid_to": "2026-11-23T12:31:41Z", "valid_from": "2026-08-25T12:31:42Z" }, "whois": [] } } ```