roanalacerda[.]com[.]br

The domain roanalacerda.com.br is currently active and classified as a high‑risk credential phishing site. Technical analysis shows the domain was registered on March 30, 2022 through the registrar NEWFOLD and resolves to the IPv4 address 162.241.63.71, which is geolocated to Brazil via Unified Layer. The hosting infrastructure uses Nginx and presents a Let’s Encrypt certificate (YR2). DNS configuration includes MX record mail.roanalacerda.com.br with priority 0 and authoritative nameservers ns1102.hostgator.com.br and ns1103.hostgator.com.br. The web server returns HTTP 200 and presents the page title "Not Acceptable!". Gridinsoft assigns a trust score of 0/100, and the domain appears on a single security blocklist, being actively blocked by PhishDestroy. AlienVault OTX reports one associated threat pulse, and VirusTotal records six positive detections out of ninety‑one scanners. The evidence points to a credential phishing campaign, though the specific target brand or credential collection page has not been publicly disclosed. Defenders should block the resolved IP address 162.241.63.71 and the domain roanalacerda.com.br at perimeter defenses, monitor DNS queries for the associated MX and nameserver records, and update threat intelligence feeds with the observed indicators. Further investigation is required to determine the exact phishing landing page content and any credential harvesting mechanisms.