xms[.]atendimento-urgente[.]store

Analysis of the domain xms.atendimento-urgente.store shows it was registered through GoDaddy.com, LLC on 10 June 2026 and currently resolves to the IP address 104.21.9.61. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal records indicate that 7 of 91 scanned security vendors have flagged the domain, suggesting malicious intent consistent with a generic phishing campaign.

The elevated risk rating aligns with the recent creation date, the presence on a blocklist, and the multi‑vendor detections. No public evidence of the site’s HTML content, TLS certificate, HTTP status code, or targeted brand has been disclosed, leaving the exact payload and victim‑interaction mechanisms unconfirmed.

Defenders should therefore treat the domain as hostile: add the fully qualified domain name and its resolving IP to DNS and firewall deny lists, monitor outbound traffic for connections to 104.21.9.61, and incorporate the indicator into intrusion‑detection signatures. Continuous re‑evaluation is advised, as additional analysis such as page title extraction or sandbox execution may reveal further tactics, techniques, and procedures used by the operators.