entrega[.]menudoimportador[.]com[.]br

The domain entrega.menudoimportador.com.br was registered on June 12, 2026 through GoDaddy and immediately points to the Cloudflare edge address 104.21.81.167. Its authoritative name servers are gigi.ns.cloudflare.com and josh.ns.cloudflare.com, indicating that the site is protected—or possibly obscured—by Cloudflare's CDN and DNS services. The domain appears on a single security blocklist and has been actively flagged by PhishDestroy, confirming that it is being used in a phishing campaign. VirusTotal analysis shows that five of ninety‑one scanned security vendors have identified the domain as malicious, reinforcing the suspicion of abusive activity.

No additional intelligence such as page title, SSL certificate details, HTTP response codes, or brand targeting is currently available, so the exact phishing vector (e.g., credential harvesting page, malicious download) remains undefined. Defenders should add the IP address 104.21.81.167 and the domain to network‑level deny lists, enforce DNS filtering for the domain, and monitor outbound connections to the associated Cloudflare edge. Because the domain is hosted behind Cloudflare, direct takedown may require coordination with the registrar or Cloudflare’s abuse team.

Continuous re‑scanning with VirusTotal and similar services is recommended to capture any changes in detection scores. Organizations that employ email or web security gateways should ensure the domain is blocked in those controls, and incident response teams should treat any communications referencing this domain as potentially compromised. The limited visibility into the payload underscores the need for proactive containment while further forensic analysis is pursued.