centralemmacolchoes[.]com

The domain centralemmacolchoes.com was registered on February 23, 2026 through NiceNIC International Group Co., Limited. The site’s page title reads “Emma Colchões | Colchão Alemão Original - O Melhor do Brasil,” indicating an attempt to impersonate a Brazilian mattress retailer. DNS resolution points to the single IPv4 address 216.198.79.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain uses the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com and does not present an SSL/TLS certificate, meaning traffic is served over HTTP only. As of the report date the host is reported offline, and the domain has been taken down.

Threat intelligence shows the domain is flagged by PhishDestroy and appears on one public security blocklist. On VirusTotal, two of ninety‑three scanning engines flagged the domain as malicious, providing independent confirmation of suspicious activity. No additional detection counts are available beyond the two positive detections. The lack of an SSL certificate, combined with the recent registration date and the use of a generic e‑commerce‑style page title, aligns with the generic phishing classification.

Uncertainties remain because the exact content of the landing page has not been captured, so the specific phishing vector cannot be confirmed, and no Safe Browsing or Open Threat Exchange identifiers were supplied. Defensive teams should continue to block centralemmacolchoes.com at DNS and web proxy layers, enforce TLS inspection policies to detect any future activation of HTTPS, and monitor the hosting IP 216.198.79.1 for other potentially malicious domains on the same Amazon infrastructure. Incident responders should add the domain to internal blocklists and consider sharing the indicator with threat‑sharing communities. Ongoing surveillance of the registrar NiceNIC and the name servers is advised in case additional domains are created using the same registration profile.