recargabuxsbr[.]com

Analysis of the domain recargabuxsbr.com indicates it is associated with a phishing campaign targeting digital goods consumers, as evidenced by its infrastructure and detection status. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 104.21.66.25, which is hosted on Cloudflare's network (AS13335) in the United States. The domain's nameservers, gabriel.ns.cloudflare.com and mira.ns.cloudflare.com, further confirm its reliance on Cloudflare's infrastructure. The domain is flagged by one security blocklist, specifically PhishDestroy, and holds a Gridinsoft trust score of 0/100, indicating elevated risk.

VirusTotal reports that 2 out of 93 security vendors have detected the domain as malicious, though this does not constitute conclusive evidence of its intent. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare. At the time of analysis, the domain returned an HTTP 500 status code, suggesting it may be temporarily offline or experiencing technical issues. The page title, 'RECARGABUX - Sua Loja de Produtos Digitais | Entrega Automática 24h,' implies the site was designed to mimic a digital product store offering automated 24-hour delivery, a common phishing tactic to lure victims into entering payment or personal details.

Technologies detected on the domain include Google Tag Manager, Google Analytics, Facebook Pixel, and Cloudflare Browser Insights, which are frequently used for tracking user behavior but are not inherently malicious. Defenders should treat this domain as high-risk due to its registration details, hosting on Cloudflare, and detection by security vendors. While the exact content of the phishing kit remains unanalyzed, the combination of its page title, trust score, and blocklist presence warrants immediate blocking in enterprise and consumer security tools.