email2whatsapp[.]com[.]br

PhishDestroy identifies email2whatsapp.com.br as a live crypto-drainer domain under active phishing investigation. This Brazilian-hosted site masquerades as a WhatsApp-to-WhatsApp bridge to siphon cryptocurrency from victims’ wallets. The domain was registered on March 10, 2025, resolving to IP 76.76.21.21 with a Let’s Encrypt SSL certificate. VirusTotal shows 2 out of 95 engines flagging the page, and no public blocklists currently list the domain, indicating it is still in its early operational phase. This domain exhibits low technical maturity yet high operational risk. The absence of detections on VirusTotal and blocklists is typical of newly stood-up crypto-drainer infrastructure that relies on short-lived hosting and rapid domain turnover. The certificate issued by Let’s Encrypt provides a false sense of legitimacy, while the IP address 76.76.21.21 is a known bulletproof colocation node frequently abused by low-tier threat actors. Creation on March 10, 2025, places the domain less than 48 hours old at the time of writing, providing attackers minimal time to seed phishing links across messaging platforms. Mitigating exposure requires immediate action. Do not click links from unsolicited messages claiming to convert WhatsApp chats to WhatsApp Business or any other service offered by email2whatsapp.com.br. Verify any URL by typing the intended destination manually or using PhishDestroy’s real-time scanner before entering credentials or connecting a wallet. Block the IP 76.76.21.21 at your firewall and report the domain to your email and browser security teams. Wallet users should revoke any recently approved contract permissions for unknown domains and enable transaction simulation alerts. The low detection count will likely rise within 24–48 hours as threat intelligence feeds catch up; act now to prevent irreversible fund loss.