guinchobrasil[.]sbs

This domain is flagged as a high-risk credential phishing site targeting users seeking emergency roadside assistance services. Analysis indicates the domain guinchobrasil.sbs impersonates Guincho Goiânia, a legitimate 24-hour towing and vehicle recovery service, to harvest login credentials, payment details, or personal information from unsuspecting victims. Infrastructure analysis reveals the domain resolves to IP address 172.67.152.82 and was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. Detection metrics show 3 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on one security blocklist. The domain is also referenced in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing infrastructure. Current monitoring confirms the site remains active and unmitigated. To mitigate risks associated with this credential phishing campaign, network defenders should immediately block the domain guinchobrasil.sbs and its resolving IP 172.67.152.82 at the perimeter. Endpoint protection systems should be updated to detect and quarantine any artifacts associated with this domain. Users who may have interacted with the site should be instructed to reset credentials for any accounts entered, enable multi-factor authentication where available, and monitor financial statements for unauthorized activity. Organizations should conduct retrospective log analysis to identify any prior engagement with this domain and assess potential data exposure.