noticiasbrasil[.]shop

Noticiasbrasil.shop was observed hosting a generic phishing campaign and has been taken offline as of July 23, 2026. The domain lacks an SSL certificate and resolves to the IPv4 address 167.99.0.129, which belongs to AS14061 DigitalOcean, LLC and is geolocated in the United States. DNS resolution is provided by Cloudflare name servers ryan.ns.cloudflare.com and sonia.ns.cloudflare.com. The HTTP response returned the page title “Server Managed by KeepCloud,” but no further content was captured before the takedown.

Threat intelligence sources record the domain in fifteen AlienVault OTX pulses and on a single public blocklist. PhishDestroy has already added the domain to its blocklist, and Gridinsoft assigns a trust score of 0 out of 100. VirusTotal analysis shows fifteen of ninety‑five security vendors flagging the domain as malicious. The registrar entry shows registration through DIGITALOCEAN-167-99-0-0, confirming the hosting provider.

While the exact phishing lure and target brand are not disclosed in the collected metadata, the combination of low trust score, multiple vendor detections, and presence in threat‑intel pulses indicates a high likelihood of credential‑harvesting activity. Defenders should continue to block the domain at perimeter firewalls, update DNS sinkhole lists, and monitor for any resurgence of the associated IP address. Additional investigations should focus on extracting the captured HTTP payloads, if any, and correlating the OTX pulse identifiers with ongoing campaigns to improve attribution.