kimurafotoimagem[.]com[.]br

This domain, kimurafotoimagem.com.br, is confirmed to facilitate credential theft, targeting users through deceptive login portals designed to mimic legitimate services. Analysis indicates the site employs obfuscated scripts to capture entered usernames, passwords, and potentially multi-factor authentication codes, exfiltrating them to attacker-controlled infrastructure. The domain’s structure and content suggest it is tailored to impersonate Brazilian photography or imaging platforms, leveraging familiarity to lower user vigilance during interactions. Infrastructure analysis reveals the domain was registered on February 21, 2026, through R4.br, and resolves to the IP address 177.84.130.146, hosted on AS262586 (R4 Informática Ltda). The SSL certificate, issued by Let’s Encrypt (R13), does not mitigate the malicious intent, as 13 out of 95 security vendors on VirusTotal flag the domain as malicious. Additionally, the domain appears on one security blocklist, and its page title, 'Index of /', suggests an exposed directory structure, which may indicate poor operational security or intentional misconfiguration to evade detection. Users who visited kimurafotoimagem.com.br or entered credentials on the site should immediately revoke any submitted login information, particularly for accounts associated with Brazilian services or photography platforms. Reset passwords using a secure, unrelated device, and enable multi-factor authentication where available. Monitor linked accounts for unauthorized activity, and consider reporting the incident to local cybersecurity authorities or the affected service providers. If financial or sensitive personal data was entered, initiate fraud alerts with relevant institutions.