revseguro[.]com

revseguro.com was observed serving a page titled “Cartão de Crédito” and returned HTTP 200 responses before being taken offline. The site employed a Let’s Encrypt certificate (E7) and was hosted on an Nginx server. DNS resolution pointed to 79.133.41.108, an address allocated to AS214036 (Ultahost, Inc.) in Germany. The domain was registered on 11 March 2026 through Dynadot LLC and uses four CloudNS nameservers (pns61.cloudns.net, pns62.cloudns.com, pns63.cloudns.net, pns64.cloudns.u…). Security vendors have flagged the domain; one of ninety‑five VirusTotal scanners reported it as malicious, and it appears on a single public blocklist.

PhishDestroy has also listed the domain as a phishing source. No additional intelligence such as a targeted brand or payload details is publicly available, and the site is no longer reachable, limiting real‑time analysis of its content. The page title in Portuguese implies a credential‑harvesting page aimed at Portuguese‑speaking users seeking credit‑card services. Defenders should block the IP address 79.133.41.108 and add revseguro.com to URL filtering and sinkhole rules.

Monitoring of the associated nameservers and the registration record for changes is advised, as the infrastructure could be reused for future campaigns. Because the certificate is publicly trusted, network‑level inspection of TLS handshakes may be required to detect similar domains that use Let’s Encrypt for short‑lived phishing sites. The single blocklist listing, combined with the VirusTotal flag, indicates that the domain has already been identified by threat‑intelligence feeds, but the limited detection count suggests it was either short‑lived or not widely distributed. The lack of further artifacts suggests a stand‑alone campaign rather than a larger botnet, but analysts should remain vigilant for other domains resolving to the same IP or sharing the same nameserver set.