gratisbrasil[.]com[.]br

This domain is flagged for elevated-risk generic phishing activity targeting Brazilian e-commerce users. Analysis indicates the infrastructure was specifically designed to mimic legitimate WhatsApp-MercadoPago integration for delivery services, as evidenced by the page title 'Delivery online via WhatsApp integrado com Mercadopago.' The threat primarily involves credential harvesting and unauthorized financial transactions through fake payment portals. Infrastructure analysis reveals the domain gratisbrasil.com.br was registered on April 12, 2026, through an undisclosed registrar. It resolves to IP address 82.112.247.150, hosted in Brazil by a provider known for shared hosting environments. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. VirusTotal detection metrics show 13 out of 95 security vendors flagging the domain as malicious, with a Let's Encrypt R13 SSL certificate providing superficial legitimacy. The domain was operational for a limited period before being taken offline. Mitigation for this specific threat type involves several technical measures. Network administrators should implement DNS-based blocking for 82.112.247.150 and the gratisbrasil.com.br domain across all organizational endpoints. Users who may have interacted with the site should immediately revoke any MercadoPago API credentials or payment authorizations, as these are primary targets of the phishing scheme. Financial institutions should monitor for unusual transaction patterns originating from devices that visited this IP address during the active period. Organizations should also conduct security awareness training focusing on WhatsApp-integrated payment scams, particularly those targeting delivery services in Brazil.