andersonmorais[.]com

This domain, andersonmorais.com, is currently flagged as a high-risk generic_phishing site designed to harvest user credentials or sensitive information. Analysis indicates no direct association with a specific brand or drainer kit, though the page title 'Início | Meusite 1' suggests a generic template often repurposed for fraudulent login portals. The lack of brand-specific elements may allow the site to adapt quickly to different phishing lures, increasing its versatility as a threat vector.

Infrastructure analysis reveals several technical indicators of compromise. The domain was registered on March 31, 2024, through GoDaddy.com, LLC, and resolves to the IP address 172.67.183.129, which is part of a network frequently associated with malicious activity. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, a low detection rate that may indicate evasion techniques or recent deployment. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. No listings were found on Google Safe Browsing at the time of assessment, though this does not preclude malicious intent. Additional blocklist monitoring shows limited but growing awareness of the threat.

As of the latest assessment, andersonmorais.com remains active and operational, posing an ongoing risk to users. The domain's recent creation date and low detection rate suggest it may still be in the early stages of its malicious campaign. Recommended response actions include blocking the domain and IP at the network level, monitoring for related subdomains or redirects, and alerting users to the threat. Despite its current low detection rate, the domain's infrastructure and behavior align with known phishing patterns, warranting continued vigilance and proactive mitigation measures.