tesourosdobrasil[.]com[.]br

On July 27, 2026, intelligence analysts observed that the domain tesourosdobrasil.com.br remains active and is associated with a generic phishing campaign. The domain was registered through the registrar HSTDOMAINS on April 5, 2019 and is delegated to the parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. DNS resolution points to the IPv4 address 2.57.91.202. The address appears on at least one public security blocklist and the domain has been explicitly blocked by the PhishDestroy feed. VirusTotal scans show that two of ninety‑one antivirus or URL‑reputation engines flagged the domain as malicious, indicating that a minority of scanners have identified it as suspicious.

The threat record lists a unique seed identifier 567774 and assigns a high risk level, confirming that the domain is considered a priority target for mitigation. No additional public signals such as Safe Browsing warnings, Open Threat Exchange entries, SSL certificate details, HTTP status codes, or page‑title metadata have been published for this host, so the surface of the malicious payload remains unknown. The available evidence suggests that the infrastructure is intentionally minimal, relying on a parked domain and a single IP address to host phishing content. The high risk rating reflects the combination of active status, confirmed detection by multiple vendors, and inclusion on a dedicated anti‑phishing blocklist. Two security vendors flagged the domain, which aligns with its presence on one blocklist, demonstrating that detection is not uniform across the security ecosystem.

Defenders should add tesourosdobrasil.com.br and its resolving IP 2.57.91.202 to network‑level deny lists, enforce URL filtering policies that block the domain, and monitor for any outbound connections to the IP. Continuous re‑scanning with VirusTotal or similar services is recommended to detect further changes in detection scores.