finance-estadao[.]sbs

PhishDestroy identifies finance-estadao.sbs as an active brand impersonation and credential theft campaign targeting Estadao users. The domain mimics the legitimate Brazilian news outlet to harvest login credentials and sensitive data. No crypto drainer kit is observed in the payload, indicating a focus on traditional account compromise rather than asset drainage. The threat actor leverages a lookalike domain to deceive victims into entering credentials under the guise of a 'secure authentication portal.'

This domain was flagged with the following technical indicators: registered on March 31, 2026, through Dynadot LLC, resolving to IP 188.114.97.3. It employs a Let's Encrypt SSL certificate for credibility and currently shows 4/95 VirusTotal detections, with 1 security blocklist presence. The domain is actively blocked by SEAL, the enterprise security platform.

Current status remains active but contained, with SEAL providing initial mitigation. Remaining risk includes potential credential harvesting if the block fails, and domain persistence via DNS cache poisoning or new blocklist entries. Users should avoid accessing the domain and report any suspicious login attempts to Estadao’s security team. Continuous monitoring is advised until the domain is sinkholed or taken offline.