funciona[.]com[.]br

The domain funciona.com.br has been flagged as a generic phishing threat by PhishDestroy, with an elevated risk level. The site masqueraded as 'Funciona Eletrorefrigeração,' likely impersonating a legitimate business in the refrigeration sector. No specific drainer kit was identified, but the generic phishing nature suggests potential credential harvesting or financial fraud targeting customers of the brand.

Technical analysis reveals that the domain resolves to IP address 64.37.59.26 and uses an SSL certificate issued by Let's Encrypt (R13). VirusTotal reports a score of 5 out of 95 security vendors flagging this domain as malicious. The registrar information is not publicly listed, but the domain was created on June 21, 2006, indicating it is a long-standing domain that may have been compromised. Google Safe Browsing (GSB) status is not mentioned, but the domain appears on 1 security blocklist, suggesting limited but confirmed malicious activity.

Currently, the domain is offline, having been taken down in response to the threat. However, residual risk remains as the domain could be reactivated or used for further attacks. Users who may have interacted with the site should monitor for phishing attempts and change any credentials used on the page. PhishDestroy advises staying vigilant against similar impersonations and verifying website authenticity before entering sensitive information.