pagina-do-participante[.]com

Analysis of pagina-do-participante.com indicates a confirmed phishing domain targeting employee benefits or participant portals, classified under an elevated risk level. The domain, registered on February 21, 2026, through NICNAMES, INC., was taken offline by July 24, 2026, following detection by security vendors. Infrastructure analysis reveals the domain resolved to IP address 80.78.24.23, hosted on AS39287 (Materialism s.r.l.) in Denmark. Nameservers ns10.uadns.com, ns11.uadns.com, and ns12.uadns.com were configured, alongside an MX record pointing to mail.pagina-do-participante.com with priority 10, suggesting email capabilities were part of the phishing infrastructure.

The domain was flagged by one security vendor on VirusTotal and appears on a single blocklist, corroborated by PhishDestroy’s classification. Gridinsoft assigned a trust score of 0/100, reinforcing the malicious classification. The SSL certificate was issued to blink.capital, a detail that may indicate shared infrastructure or a compromised certificate authority. The observed page title 'Privacy error' aligns with tactics used to mislead users into bypassing browser warnings, a common phishing technique.

While the exact content of the phishing page remains unanalyzed, the domain’s naming convention ('pagina-do-participante,' Portuguese for 'participant page') suggests targeting of employee benefits, corporate portals, or government program participants. Defenders should treat this domain as compromised and block all resolutions, including subdomains and associated MX records. The hosting provider and registrar should be notified for takedown procedures, and any SSL certificates linked to blink.capital warrant further scrutiny for potential abuse patterns. Given the domain’s offline status, monitoring for re-emergence under similar naming schemes or infrastructure is recommended.