pacotes[.]menudoimportador[.]com[.]br

This domain, pacotes.menudoimportador.com.br, was registered on June 12, 2026, through GoDaddy and is currently active as of July 29, 2026. Infrastructure analysis reveals it resolves to the IP address 104.21.81.167, which is associated with Cloudflare's network, a common proxy service used to obscure hosting origins. The domain appears on one security blocklist and is blocked by PhishDestroy.

VirusTotal reports that 4 out of 91 security vendors flag this domain as malicious, indicating a consensus among some detection engines regarding its risk. No specific brand target or phishing kit details are provided in the available intelligence, though the subdomain 'pacotes' (Portuguese for 'packages') suggests a potential focus on courier, shipping, or parcel-related scams, a common tactic in phishing campaigns targeting logistics or e-commerce sectors. Defenders should treat this domain as elevated risk due to its recent registration, use of proxy services, and detection by multiple security vendors.

Immediate actions include blocking the domain and IP at perimeter security controls, monitoring for internal connections to 104.21.81.167, and reviewing logs for any prior interactions. Further analysis of the site's content is required to confirm the exact nature of the threat, as the current data does not provide details on page structure, login forms, or specific brands being impersonated. Given the domain's registration through a major registrar and its presence on a blocklist, this infrastructure is likely part of a broader phishing operation rather than an isolated incident.