afoshaclass[.]com[.]br

Analysis of afoshaclass.com.br indicates a high-risk phishing domain actively impersonating Facebook, as identified by multiple threat intelligence sources. The domain was registered on May 6, 2019, and remains operational as of July 23, 2026. Infrastructure analysis reveals hosting on IP 108.167.168.29, located in the United States under AS19871 (Network Solutions, LLC). Nameservers point to ns324.hostgator.com.br and ns325.hostgator.com.br, while MX records configure mail.afoshaclass.com.br with priority 0, suggesting potential email-based attack vectors. Detection data shows 11 of 95 security vendors on VirusTotal flagging the domain, and it appears on at least one security blocklist.

Gridinsoft and Scamadviser both assign trust scores of 1/100, reinforcing the malicious classification. AlienVault OTX includes the domain in 17 threat intelligence pulses, further corroborating its association with phishing campaigns. The site returns an HTTP 200 status, indicating active content delivery, and employs a Let's Encrypt SSL certificate (R12), which provides encryption but does not validate legitimacy. Technologies detected include WordPress, MySQL, PHP, Apache HTTP Server, and front-end libraries such as jQuery and Font Awesome. The page title—'AFOSHACLASS – ASSOCIAÇÃO, HABITACIONAL, ESPORTE, CULTURA, LAZER E FORMAÇÃO PROFISSIONALIZANTE DOS TRABALHADORES NO RAMO DA SEGURIDADE SOCIAL NO ESTADO DA BAHIA'—does not explicitly reference Facebook, though the domain is explicitly categorized as a social media phishing scam targeting the platform.

The registrar remains unidentified, limiting attribution. Defenders should prioritize blocking the domain and its associated IP across network security controls. Email filtering systems should flag messages originating from or linking to afoshaclass.com.br, particularly those referencing Facebook. SOC teams should monitor for connections to 108.167.168.29 and correlate with known Facebook phishing indicators.