mbakids[.]com[.]br

Analysis confirms that mbakids.com.br is actively serving a generic phishing campaign. The domain was registered on February 21 2026 through the registrar Mbakids.br and resolves to the IP address 35.172.94.140, which belongs to Amazon.com, Inc. (AS14618) in the United States. DNS resolution uses Cloudflare nameservers alex.ns.cloudflare.com and jill.ns.cloudflare.com, and the site presents HTTP 200 responses over a TLS certificate issued by Google Trust Services (WE1). The presence of HTTP Strict Transport Security (HSTS) indicates that the server enforces secure connections. The page title returned by the web server is “MBA Kids — Educação Tecnológica para Crianças”, but no further content analysis is available.

Threat intelligence sources corroborate malicious activity: AlienVault OTX references the domain in fifteen separate pulses, and PhishDestroy has added it to its blocklist. VirusTotal scans show eight of ninety‑five security vendors flagging the domain, and a single external blocklist also lists it. The Gridinsoft trust score is 1 out of 100, reflecting an extremely low reputation. The domain currently appears on one security blocklist and remains reachable. Uncertainties remain regarding the specific phishing payload, target audience, and any credential‑harvesting infrastructure behind the site, as no page‑level details have been disclosed.

Defenders should block traffic to mbakids.com.br at the network perimeter, enforce DNS sinkholing, and monitor for outbound connections to the associated IP address. Continuous re‑scanning with multi‑engine services is advised to capture any changes in vendor detections. Organizations using email filters should add the domain to block lists and treat any communications referencing “MBA Kids” as malicious. Ongoing observation of the Cloudflare‑hosted infrastructure is recommended, given the rapid creation date and active status.