emktlw[.]com[.]br

The domain emktlw.com.br was registered on February 21, 2026 through the LOCAWEB registrar and is presently active. DNS resolution points to the IP address 186.202.135.197, which belongs to AS27715 Locaweb Serviços de Internet S/A located in Brazil. The host presents a GlobalSign nv-sa / GlobalSign GCC R6 AlphaSSL CA 2025 certificate, indicating a valid TLS chain, and the HTTP response is a 302 redirect, a behavior often used to forward victims to credential‑harvesting pages. The page title returned by the server is "Autenticação Locaweb," suggesting the site is attempting to impersonate a legitimate Locaweb authentication portal.

Security‑reputation services uniformly score the domain very poorly; Gridinsoft assigns a trust rating of 1 out of 100, Scamadviser records the same score, and the domain appears on at least one public blocklist, specifically PhishDestroy. VirusTotal analysis shows that 12 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. AlienVault OTX lists the domain in sixteen distinct threat‑intel pulses, indicating repeated observations across multiple feeds. Technical fingerprints include the deployment of reCAPTCHA, HTTP Strict Transport Security (HSTS), and Google Analytics, which are commonly observed on both legitimate and fraudulent sites but do not mitigate the underlying phishing intent.

The site is associated with the "Recovery Scam" phishing kit, a known template used to solicit credentials under the pretext of account recovery. While the exact content of the landing page has not been disclosed, the combination of a legitimate‑looking title, active redirect, low trust scores, and multiple vendor detections provides strong evidence of a high‑risk phishing operation. Defenders should block the domain at the network perimeter, add the associated IP address to deny lists, and monitor for any traffic that includes the observed user‑agent strings or analytics identifiers.