raspadinhadogalpao[.]shop

The domain www.raspadinhadogalpao.shop was registered on February 21, 2026 and is currently listed as offline. The only publicly visible artifact is the page title “Galpão da Reversa – Pacotes Secretos,” which suggests the site was intended to lure victims with promises of secret packages. Infrastructure analysis shows the domain resolves to the IP address 104.21.88.111, an address owned by Cloudflare, Inc. (AS13335) located in the United States. No TLS certificate was observed, indicating the site was served over plain HTTP.

The domain appears on a single security blocklist, specifically PhishDestroy, and is flagged by two of ninety‑three VirusTotal scanners. The elevated risk rating reflects the combination of recent registration, lack of encryption, and detection by threat intelligence sources. Because the site is no longer reachable, dynamic content cannot be corroborated, and the exact phishing payload or credential‑stealing mechanism remains unknown. Defenders should continue to block the associated IP address and add the domain to local deny lists.

Ongoing DNS monitoring is recommended to detect any potential re‑hosting or resurrection of the domain on alternative infrastructure. Organizations using web filtering should ensure that the domain is included in URL filtering policies, and incident response teams should be alert for any user reports referencing “Galpão da Reversa” or “Pacotes Secretos” in phishing emails. The limited detection footprint—one blocklist entry and two scanner flags—suggests a low‑volume campaign, but the elevated risk level warrants precautionary controls. Continuous threat‑intel feeds should be consulted for any future activity tied to this domain or its hosting provider.