whatsapp[.]prosulequipamentos[.]com[.]br

This domain, whatsapp.prosulequipamentos.com.br, is flagged as a generic phishing portal targeting WhatsApp users. Analysis of the page title, "Prosul Distribuidora - Whatsapp," indicates an attempt to impersonate a legitimate business account on the messaging platform, likely to harvest login credentials or distribute malicious payloads. No specific drainer kit signatures were identified, but the domain follows common phishing infrastructure patterns, including the use of a Let's Encrypt SSL certificate to appear legitimate. Technical indicators confirm the elevated risk classification. The domain was registered on February 21, 2026, through Hostdime.br and resolves to IP 187.33.241.46, hosted on AS53087 (TELY Ltda., BR). VirusTotal detections stand at 18/95 security vendors, while it appears on a single blocklist (PhishDestroy). The SSL certificate, issued by Let's Encrypt (R12), was likely automated to evade basic security checks. No entries were found in Google Safe Browsing at the time of analysis, suggesting either recent takedown or evasion techniques. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered, and the IP may still host other malicious content. Organizations are advised to block the domain and IP at the perimeter, monitor for related subdomains, and alert users to similar phishing lures. The creation date (February 2026) suggests either a typo or future-dated registration, warranting further investigation into the registrar's handling of fraudulent domains. No additional payloads or C2 communications were observed, but historical DNS records should be preserved for forensic analysis.