itaubenefisio[.]com[.]br

This domain, itaubenefisio.com.br, is flagged as a high-risk brand impersonation threat targeting Banco Itau, a major financial institution. Analysis of the page title reveals a fraudulent invoice interface labeled 'Fatura | Hipercard,' which is designed to deceive victims into entering sensitive financial credentials. While Banco Itau is the primary impersonated brand, the inclusion of Hipercard—a credit card service—suggests an attempt to exploit users of multiple financial products under a single phishing operation. No evidence of a payment drainer kit was observed, but the domain’s infrastructure and content clearly align with credential harvesting tactics. Infrastructure analysis reveals multiple concrete technical indicators. The domain resolves to IP address 89.117.7.149, hosted on AS47583 (Hostinger International Limited) with a geolocation in Brazil. It was registered on November 22, 2025, an unusually future-dated creation that may indicate domain spoofing or registrar manipulation. Google Safe Browsing has classified the domain as phishing, and 23 out of 95 security vendors on VirusTotal have flagged it as malicious. The domain appears on two security blocklists and lacks an SSL certificate, further reducing its legitimacy. No legitimate financial institution operates without encryption, making this a critical red flag. The domain is currently offline, likely due to takedown actions initiated by security providers and hosting intervention. Despite its inactive status, residual risk remains due to potential reuse of the infrastructure or migration of the phishing campaign to a new domain. Organizations should monitor for related domains using similar naming patterns, IP associations, or hosting providers. Financial institutions and users are advised to block the domain and IP at the network level and conduct internal reviews for any exposure to this campaign. Proactive monitoring of newly registered domains with financial keywords is recommended to detect future iterations.