caesmarevento[.]com[.]br

This domain is flagged as a high-risk generic phishing threat targeting users through fraudulent event registration portals. Analysis indicates the site was designed to harvest personal and financial details under the guise of legitimate event sign-ups, leveraging social engineering tactics to deceive victims. Infrastructure analysis reveals the domain was registered on December 11, 2017, through NEWFOLD and currently resolves to the IP address 104.21.65.115. It is associated with a Google Trust Services SSL certificate and employs technologies such as WordPress, MySQL, PHP, jQuery Migrate, jQuery, and Cloudflare with HTTP/3 support. The domain appears in 2 threat intelligence pulses on AlienVault OTX, is blocked by PhishDestroy and InversionDNS, and is listed on 2 security blocklists. Google Safe Browsing flags it for SOCIAL_ENGINEERING, while VirusTotal reports 15 out of 95 security vendors detecting malicious activity. The Gridinsoft trust score for this domain is 0/100, and its page title displays 'Not Acceptable!', suggesting either a defacement or a placeholder for malicious content. Mitigation steps include blocking the domain and its resolving IP (104.21.65.115) at the network perimeter. Security teams should monitor for indicators of compromise, such as unexpected redirects or credential harvesting attempts linked to this domain. End-users should be educated on recognizing social engineering tactics, particularly those involving fake event registration pages. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts. Additionally, reviewing logs for connections to the domain or its IP address can help identify potential breaches.