govbrasil[.]website

This domain, govbrasil.website, is actively engaged in credential theft targeting users of government-related services. Analysis indicates the site mimics legitimate Brazilian government portals to harvest login credentials, potentially enabling unauthorized access to sensitive personal or institutional data. The threat is classified as high-risk due to its targeted impersonation of official infrastructure, which increases the likelihood of successful deception among unsuspecting users seeking government services or information. Infrastructure analysis reveals the domain was registered on July 8, 2026, through GoDaddy.com, LLC, an atypical creation date suggesting potential domain squatting or preemptive registration for malicious use. The domain resolves to the IP address 188.114.97.3 and currently exhibits zero detections across 95 security engines on VirusTotal, indicating it has not yet been widely flagged or blocklisted. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to users unfamiliar with certificate authorities or domain validation processes. Users who have visited govbrasil.website or entered credentials on the site should immediately revoke any submitted login information, particularly for government or financial accounts. It is recommended to scan local devices for malware using updated security tools and monitor accounts for unauthorized activity. If credentials were reused across multiple platforms, those should be updated promptly. Organizations should consider proactively blocking the domain and IP address 188.114.97.3 within network security controls to prevent further exposure. Reporting the domain to relevant national cybersecurity authorities or incident response teams is also advised to support broader mitigation efforts.