Phishing detection: www-itausegurancas.rf.gd

Itaú
https://www-itausegurancas.rf.gd/?i=1 Access site
Screenshot
Screenshot of www-itausegurancas.rf.gd
Investigate
Domain www-itausegurancas.rf.gd1551 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 185.27.134.94
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://www-itausegurancas.rf.gd/?i=1
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
25 low suspicionheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +3.0 OpenPhish
  • +2.2 Country mismatch
  • +2.0 Site cluster
  • +1.4 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.7 Bulletproof DNS
  • +0.6 Brand impersonation in path
  • +0.6 Suspicious TLD
  • +0.5 Long domain
  • +0.1 Hyphens
  • +0.1 External scripts
  • +0.1 Deep subdomain
16 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site impersonating Itaú bank via a free-hosting subdomain incorporating the brand name, targeting Brazilian banking credentials. Infrastructure is hosted in the UK rather than Brazil and flagged as social engineering by Google Safe Browsing and OpenPhish.

Google Safe BrowsingOpenPhishBrand impersonation in path
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-09 · confidence 80%
Domain & Network
Whois
Registrar Key-Systems GmbH
Network
IP 185.27.134.94
Country United KingdomUnited Kingdom
Hosting Wildcard UK Limited
ASN AS34119
TLS Cert -
External detection Google Safe Browsing OpenPhish
GSB category: SOCIAL_ENGINEERING
CleanPhishTank · TweetFeed · urlscan.io
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-08-09 01:03 UTC  ·  Last refreshed 2026-08-31 03:30 UTC