mercadolivrecredito[.]com

This domain, mercadolivrecredito.com, is currently active and serves a page titled “Simulação de empréstimo”. The site resolves to the Cloudflare‑hosted IP address 188.114.97.3 and uses the Cloudflare nameservers collins.ns.cloudflare.com and gordon.ns.cloudflare.com, indicating that the infrastructure is being leveraged for anonymity and rapid re‑hosting. Registration was performed through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 name, a common configuration for abused Cloudflare‑protected sites. The domain has been observed in two AlienVault OTX threat‑intel pulses and appears on one public security blocklist. PhishDestroy has taken the domain offline in its own feed, confirming that it is being treated as a phishing‑related artifact. VirusTotal reports that the site has been scanned by 91 security vendors, none of which have issued a current detection, but the lack of a detection does not imply safety. The page title suggests a loan‑simulation lure, which is a typical vector for credential‑harvesting campaigns targeting consumers seeking credit. No additional content analysis is available, so the exact credential‑capture mechanism and any targeted brand remain unverified. Defenders should block the domain at the DNS and proxy layers, monitor for connections to the IP 188.114.97.3, and consider adding the domain to internal phishing‑watch lists. Ongoing observation is recommended until the investigation concludes.