dondoobrasil[.]com

The domain dondoobrasil.com was registered on 24 April 2026 through the registrar Fewmoretaps OU operating as Trustname.com. It is secured with a Let’s Encrypt certificate issued under R12, indicating a standard free TLS deployment. The site resolves to the IPv4 address 216.152.155.235, which maps to a hosting provider located in the United States (GTHost). The web server returns HTTP 200 responses, confirming that the host is actively serving content.

The page title returned by the server is “DonDoo Brasil — Sua plataforma de arrecadação transparente”, suggesting a claim of transparent fundraising services. No additional content analysis is available, and the site has not been publicly disclosed as mimicking a specific brand. Infrastructure analysis shows a single security blocklist entry and active blocking by PhishDestroy, while the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent.

Threat intelligence sources provide limited but consistent signals: VirusTotal reports one positive detection out of ninety‑five scanners, and AlienVault OTX references the domain in a single pulse. The domain appears on one blocklist, reinforcing its classification as a generic phishing infrastructure. The risk rating is marked as high, and the current status is listed as active, indicating ongoing operation.

Defenders should prioritize immediate containment by adding 216.152.155.235 to network deny lists and enforcing DNS‑level blocks for dondoobrasil.com. Continuous monitoring of outbound traffic for connections to the identified IP is advised, as is periodic re‑query of VirusTotal and OTX for any new detections. Where possible, threat‑hunting queries should include the exact page title phrase to capture any downstream clones or redirects. Given the recent registration date, any related credential‑stealing campaigns are likely in early stages, so rapid response can limit exposure.