drag-al[.]com[.]br

The domain drag-al.com.br was observed hosting a credential‑harvesting page that mimics the legitimate brand Drag'Eau América Latina Ltda. The page title returned by the web server reads “Drag'Eau América Latina Ltda - Líder mundial no tratamento ecológico da água,” which aligns with a typical lure used in generic phishing campaigns targeting Portuguese‑speaking users. The site is served over HTTPS using a Let’s Encrypt R12 certificate, indicating that the operator has taken steps to obtain a valid‑looking TLS certificate. DNS resolution points to the IPv4 address 162.241.54.21, which is geolocated to the United States and attributed to the Unified Layer hosting provider. The domain was registered on May 15, 2026 and returns HTTP status code 200, confirming that the landing page is actively reachable. Threat intelligence sources corroborate the malicious nature of the infrastructure. AlienVault OTX includes the domain in a single pulse, and VirusTotal reports that four out of ninety‑five scanning engines flagged the domain as malicious. Independent reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain appears on at least one public security blocklist. PhishDestroy has also listed the domain as blocked. The risk rating is classified as high and the status remains active. Defenders should add drag-al.com.br to network deny lists and configure email gateways to reject any messages that reference the domain or its associated IP address. Continuous monitoring of DNS queries for the domain and its IP is recommended to detect possible pivoting activity. Because the site uses a legitimate‑looking TLS certificate, endpoint protection that relies on certificate validation alone may not be sufficient; heuristic or URL‑reputation checks are advised.