promocao-mounjaro[.]com

On 25 July 2026 the domain promocao-mounjaro.com was observed to host a generic phishing page with the title “Concurso Detran RJ: novo edital está em estudos. Confira!”. The domain was registered on 27 February 2026 through NiceNIC International Group Co., Limited and uses Cloudflare’s authoritative name servers ricardo.ns.cloudflare.com and sandy.ns.cloudflare.com. DNS resolution points to 188.114.96.3, an IP address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. No TLS certificate was presented, indicating the site was served over plain HTTP.

VirusTotal scans show that four of ninety‑three security vendors flagged the domain, confirming malicious intent despite the low detection count. The domain has been added to a single security blocklist and is actively blocked by the PhishDestroy service. Current HTTP probing indicates the site is taken offline, but the infrastructure components remain live and could be repurposed. Defensive teams should add the domain and its resolving IP address to network‑level blocklists, enforce DNS filtering for the associated Cloudflare name servers, and monitor for re‑registration or similar domains created by the same registrar.

Continuous observation of Cloudflare‑hosted IP ranges for anomalous traffic patterns is advised, as the provider’s shared infrastructure can host multiple malicious actors. Because no SSL certificate is in use, any future re‑activation would be detectable via TLS inspection failures. Analysts should also track the registrar NiceNIC International Group for other newly created domains that share the same creation window, as this may indicate a broader campaign. The limited detection footprint suggests that the phishing campaign is either newly deployed or targeted, reinforcing the need for rapid containment.