lanches2000[.]com[.]br

PhishDestroy first observed lanches2000.com.br on Oct 24, 2025. The captured page title is “Lanches 2000 – Melhor lanche da cidade”. Current evidence score: 100/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Spamhaus DBL, and Cloudflare Radar. VirusTotal recorded 16 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, Sophos, VIPRE, Webroot on Jul 27, 2026 at 03:33 UTC. Spamhaus DBL: DBL_PHISH on Jul 14, 2026 at 18:35 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. Non-positive and contextual checks: Gridinsoft assigned a trust score of 1/100 (Suspicious); no observation timestamp was retained. AlienVault OTX listed 15 community pulse references (not vendor detections) on Mar 1, 2026 at 19:38 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:23 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:58 UTC.

Cloaking was recorded with HTTP 200 on Aug 7, 2026 at 22:16 UTC. The cloaking probe recorded content divergence conditional delivery at 1/100 on Aug 7, 2026 at 22:16 UTC: alive_content: raw=ok; http=200; via=https_proxy; server=nginx/1.24.0 (Ubuntu). Registration records for the domain list TT-20241113 (ASN: 40021) as the registrar and Jun 23, 2020 as the creation date. At collection time, the hostname resolved to 212.28.188.55 on AS40021 (CONTABO-40021, US). The recorded endpoint location is St. Louis, US. The stored server header is Apache. DOM analysis on Apr 23, 2026 at 15:22 UTC returned 100/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt / R12 as the certificate issuer with validity through Apr 27, 2026; checked Mar 11, 2026 at 12:46 UTC.

The content indicators and 3 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.