portalcrs[.]pagamentodeimportacoes[.]com[.]br

Analysis as of July 29, 2026 indicates that the domain portalcrs.pagamentodeimportacoes.com.br is actively used in a generic phishing campaign. The domain was registered on June 11, 2026 through GoDaddy and is served by Cloudflare, as evidenced by the authoritative nameservers gigi.ns.cloudflare.com and josh.ns.cloudflare.com. DNS resolution points to the IP address 172.67.145.53, which belongs to Cloudflare's network and is commonly leveraged for fast‑flux or proxy‑based malicious hosting. The site has been added to at least one public security blocklist and is flagged by the PhishDestroy sinkhole, confirming that defensive feeds consider it malicious.

VirusTotal reports that six out of ninety‑one scanning engines have classified the domain as malicious, reinforcing the suspicion raised by blocklist inclusion. No additional public reputation services such as Google Safe Browsing or Open Threat Exchange are referenced in the current intelligence set, leaving those signals unconfirmed. The lack of publicly disclosed SSL certificate details, HTTP response codes, page title, or content analysis limits the ability to attribute a specific phishing kit or targeted brand.

Given the confirmed registration details, Cloudflare hosting, and multiple vendor detections, defenders should treat the domain as a high‑confidence indicator of compromise. Recommended actions include adding the domain to outbound and inbound allow‑list exclusions, updating IDS/IPS signatures, and ensuring that email gateways block any messages containing URLs to this host. Continuous monitoring of the IP address 172.67.145.53 for new associations and periodic re‑scanning on VirusTotal or similar platforms are advised to capture any evolution in the payload or hosting configuration.