renansouza[.]com[.]br

The domain renansouza.com.br was registered on 21 February 2026 and remains active as of 12 July 2026. The site presents a page titled “Sistema de Controle de Carro‑Pipa”, which mimics a vehicle‑water‑truck control interface commonly used in Brazil. HTTP responses indicate a 302 redirect, suggesting an attempt to steer users to a credential‑harvesting page.

Technical inspection shows the domain resolves to IP address 185.27.133.17, which belongs to AS34119 Wildcard UK Limited and is geolocated in Great Britain. Authoritative nameservers are ns1.acoper.com.br and ns2.acoper.com.br. The web server is identified as Apache behind Cloudflare, delivering content built with PHP, Bootstrap, Chart.js, jQuery CDN, SweetAlert2, and jsDelivr. The site uses a valid Let's Encrypt (R12) TLS certificate.

Threat intelligence flags this infrastructure as a high‑risk generic phishing operation. The page has been blocked by PhishDestroy and appears on one external blocklist. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 2 of 95 security vendors have flagged the domain, reinforcing the malicious intent. The combination of a recent registration, rapid deployment of a phishing‑oriented UI, and low trust metrics indicates a purpose‑built campaign rather than an accidental compromise.

Defenders should add renansouza.com.br to network‑level deny lists and enforce DNS sinkholing where possible. Monitoring for outbound connections to 185.27.133.17 and for traffic directed to the identified subresources (Chart.js, SweetAlert2, etc.) can help detect compromised clients. Continued verification of the URL redirection chain is advised to capture any downstream payloads. Organizations should also educate users about the “Sistema de Controle de Carro‑Pipa” impersonation to reduce credential exposure.