laracastilhoevento[.]com[.]br

On July 23 2026 the domain laracastilhoevento.com.br was observed to be taken offline. The site was registered on 22 September 2025 and uses the generic parking nameservers ns1.dns‑parking.com and ns2.dns‑parking.com. No TLS certificate was presented, indicating that the service was delivered over plain HTTP before shutdown. The page title returned by the last HTTP response was “Shopee no automático | Lara Castilho”, which does not reference the impersonated brand but the intelligence tags classify the activity as a brand‑impersonation campaign targeting WhatsApp.

The domain resolves to the IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Reputation checks show a Gridinsoft trust score of 0 / 100 and 15 of 95 VirusTotal scanners flagged the domain as malicious. AlienVault OTX lists the domain in 16 threat‑intel pulses, and it appears on one external security blocklist. PhishDestroy has also blocked the domain.

The registrar is not disclosed. Because the site is currently offline, active payload delivery cannot be confirmed, but the combination of a low trust score, multiple vendor detections, and inclusion in OTX pulses strongly suggests a malicious intent consistent with brand impersonation. Defenders should continue to block the domain and the associated IP at perimeter and DNS layers, monitor for any re‑registration or re‑activation, and add the domain to internal threat‑intel feeds. Additional investigation should focus on any recent HTTP traffic to the IP, correlation with WhatsApp‑related credential‑theft campaigns, and verification of related domains that share the same nameservers or hosting infrastructure.