brazilnex[.]co

Analysis of the domain brazilnex.co, observed as offline at the time of reporting on July 25, 2026, indicates a clear association with malicious activity. The site was registered on June 06, 2025 through Gname.com Pte. Ltd. and is hosted behind Cloudflare’s network, resolving to IP address 104.26.7.12, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 authority, confirming that the site employed a valid HTTPS endpoint despite its illicit use. The page title returned from the host is "BrazilNex," but no additional content has been captured, leaving the exact phishing payload or credential‑stealing mechanisms unverified.

Threat intelligence sources reinforce the malicious profile: eight of ninety‑five VirusTotal scanners flagged the domain, it is listed on a public security blocklist, and PhishDestroy has actively blocked it. AlienVault’s Open Threat Exchange records the domain in a single pulse, and the Scamadviser trust score of 1 out of 100 further underscores its low legitimacy. The domain’s current offline status does not eliminate risk; the infrastructure—particularly the Cloudflare edge and the Google‑signed certificate—could be re‑activated quickly to resume phishing campaigns.

Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor the associated IP range for any resurgence of activity. Incident responders should treat any emails or messages referencing "BrazilNex" as potentially malicious and enforce credential‑verification procedures. Ongoing surveillance of the registrar Gname.com and the Cloudflare nameservers (chip.ns.cloudflare.com, walk.ns.cloudflare.com) is advised to detect future domain registrations that may reuse this infrastructure.