fazendaltda2026[.]weebly[.]com

PhishDestroy confirms fazendaltda2026.weebly.com is an active credential theft page hosted on Weebly. The site impersonates a legitimate Brazilian business (Fazenda Ltda) to harvest login credentials and crypto wallet seeds under the guise of an investment or service portal. No known crypto-drainer kit signatures were detected in public scans, suggesting a lower sophistication level focused on direct account takeover rather than automated fund draining. The campaign appears to leverage brand impersonation of a well-known local entity to lower victim suspicion and increase success rates.

This domain resolves to IP 74.115.51.9 and is registered via MarkMonitor, Inc. The domain was created on March 29, 2006, and currently carries a VirusTotal detection score of 1/95 security vendors. It has no listed status in Google Safe Browsing (GSB) and is not widely blocked across major threat intelligence platforms, indicating limited global exposure and recent deployment. The long registration history suggests potential abuse of an aged domain rather than a newly registered fraudulent one.

As of the latest check, the site remains active with an elevated risk status. Users are advised to avoid interacting with fazendaltda2026.weebly.com and to report the domain to hosting providers and security teams. The current threat level remains elevated due to the active hosting environment and lack of widespread blocking, indicating ongoing potential for victimization. Immediate defensive actions include domain blocking, user awareness training, and continued monitoring for infrastructure shifts.