docdireto[.]com

This domain, docdireto.com, is identified as a credential harvesting phishing site targeting users with the promise of "Acesso Discreto a Dados" (Discreet Data Access). Analysis indicates the site mimics legitimate document access portals, likely designed to capture login credentials or sensitive personal information. No specific brand impersonation or known drainer kit signatures were detected, though the Portuguese-language interface suggests targeting of Brazilian or Portuguese-speaking users. The infrastructure exhibits typical phishing characteristics without advanced evasion techniques. Infrastructure analysis reveals docdireto.com was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. The domain resolves to IP address 104.21.81.245 and uses a Let's Encrypt SSL certificate, a common tactic to appear legitimate. VirusTotal reports 1/95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is referenced in one AlienVault OTX threat intelligence pulse. Google Safe Browsing status is not explicitly stated, but the domain is currently blocked by at least one security filter. As of the latest assessment, docdireto.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed. The creation date in 2026 suggests either a typo-squatting attempt or a placeholder for future malicious campaigns. Organizations should monitor for related infrastructure, particularly domains registered through the same registrar or resolving to the same IP range. Users who accessed the site should reset credentials for any services with reused passwords and enable multi-factor authentication where available. The elevated risk level persists due to the domain's registration status and historical malicious activity.