Verdict
nomeudinheiromandoeu.com.br shows high-risk / scam indicators.
This assessment found strong scam indicators. Do not pay, sign in, or share personal details with this site.
| What this site appears to be | A Portuguese-language site presenting consumer guidance and promotional offer listings (discounts, Black Friday, flash fares) and warnings about deceptive commercial tactics. Content mentions investment-related terms (e.g., 'fundos de investimento') and a coin name but provides no transactional interfaces in the supplied HTML. |
|---|
Evidence status and limitations
Evidence completeness: UNKNOWN
- The real-world operator identity was not independently verified.
- Module-level completeness metadata is unavailable for this legacy report.
At a glance
The checks that decide most of this verdict.
| Malware engines | 9 flagged itVirusTotal | Risk |
|---|---|---|
| Google Safe Browsing | Not listedGoogle | Clear |
| Abuse reports on the host | 0 reportsAbuseIPDB; shared hosting inflates this count | Noted |
| Domain age | 8.7 years oldRegistered history | Clear |
| Web archive | Archived since 2018Public history exists | Clear |
| Certificate | Encrypted connectionIssued by YR1 | Noted |
The page as captured
Key findings
- Automated classification: Sensitive Interaction Risk.
- Domain age: 3 to 10 years (registration continuity).
- Public web-archive history exists since 2018.
- At least one reputation service TrustSniffer consulted had flagged this domain at assessment time.
Full analysis
Security Alert
Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.
This Portuguese-language website, “No Meu Dinheiro Mando Eu,” presents consumer guidance on discounts, Black Friday promotions, flash fares, financial awareness, and warnings about deceptive commercial practices. Its apparent business model is informational and promotional, potentially supported by advertising, promotions, or affiliate activity rather than direct transaction processing.
Scam/Impersonation Risk
Contradictory security signals are present. External threat intelligence identifies the domain as blacklisted, with nine malicious detections and one suspicious detection; Fortinet and Sophos are among the flagged vendors. These findings materially outweigh the comparatively benign homepage presentation and create a critical risk posture for sensitive interaction. The observed behavior also included suspicious inline scripts, substantial post-interaction DOM changes, and suspicious network classifications. The supplied page content itself did not show a login form, sensitive form, wallet connection, or transactional interface, and no brand impersonation or identity inconsistency was identified in the page analysis; however, those absences do not resolve the confirmed external detections.
- The homepage presents consumer-finance warnings, promotional offers, “fundos de investimento,” “XPTCOIN,” credit-card offers, and extra-income opportunities, but the supplied HTML contains no transactional interface or sensitive form.
- External reputation assessment recorded 9 malicious detections, 1 suspicious detection, and Tier 1 detections from Fortinet and Sophos; blacklist status was confirmed by VT and EXTERNAL_BLACKLIST.
- Behavioral analysis recorded 2 suspicious inline scripts, 981 maximum DOM differences after interaction, 12 external XHR requests, and 8 external POST requests.
Regulatory Verification Notes
The site’s apparent informational business model is not itself evidence of unlawful activity, but its financial references and promotional content warrant a clear distinction between consumer education and regulated financial services. The supplied homepage content does not display a legal entity, licensing authority, or license number, while the registration record names “ASSOC BRAS DAS ENTID FECHADA DE PREV COMPLEMENTAR”; the available evidence does not independently verify that this registrant operates the website. The domain is established and the transport layer is valid, but these technical attributes do not establish regulatory authorization or operator identity. No matching third-party broker signal was identified.
- The homepage contains no visible license authority or license number and identifies no clearly stated operating legal entity in the supplied content.
- Registration record: created 2017-12-06, age 8.71 years, expiring 2026-12-06; registrant listed as “ASSOC BRAS DAS ENTID FECHADA DE PREV COMPLEMENTAR.”
- TLS certificate: issuer YR1, DV validation, valid to 2026-11-17T05:14:47+00:00.
- The homepage has no login or sensitive-data form, and its stated content category is informational consumer guidance rather than a demonstrated transaction platform.
What to Verify Next
Before any sensitive interaction, the site’s operator should be independently connected to the named registrant through authoritative corporate or institutional records, and any financial or promotional claim should be checked against the relevant Brazilian regulatory register. Contact channels and any proposed payment destination should be confirmed through an independently sourced route rather than relying solely on site-provided details. Until those checks are complete, credentials, payment information, account creation, and financial commitments should not be submitted.
- The supplied content does not independently establish the relationship between the website and the named registrant.
- No licensing authority or license number is displayed in the supplied homepage material.
- The site presents financial-awareness content alongside investment, credit-card, and income-opportunity references, requiring claim-specific regulatory verification.
Summary Verdict
The overall posture is critical, with legitimacy and operator identity not established to a standard suitable for sensitive engagement. The confirmed external threat detections and associated contradictions require the website to be treated as unsuitable for login, credential submission, or financial activity.
Infrastructure Integrity
The website is protected by an AWS CDN/WAF, and the observed address was an edge address rather than an independently exposed origin. This provides a meaningful infrastructure-mitigation signal against direct origin exposure, but CDN/WAF protection is not evidence that the operator or content is legitimate.
- Served from AS16509, AMAZON-02 - Amazon.com, Inc., US; observed edge IP 177.71.139.205 in Brazil.
- Infrastructure analysis identified AWS CDN/WAF protection, with 1 edge IP and 0 likely origin candidates.
Closing Assessment
Prospective users should restrict activity to passive review unless independent operator, regulatory, and contact-channel checks produce satisfactory results; sensitive actions should remain suspended in the interim.
Written analysis generated 2026-08-21 by the TrustSniffer Analysis Engine from the evidence in this report.
What the analysis found
2 findings contributed to this verdict, raised by registration and ownership, analysis engine, behaviour in a sandbox, external reputation.
01 Governance Risk
- The public registration record for this domain is incomplete.Registration and ownership
rule:KF_WHOIS_INCOMPLETE
02 Sensitive Interaction Risk
- The analysis matched a pattern TrustSniffer treats as a direct threat to a visitor.Analysis engine
signal:direct_threat - The page carried inline scripts written in a style TrustSniffer treats as suspicious.Behaviour in a sandbox
rule:BEHAV_SUSPICIOUS_INLINE_SCRIPTS - The structure of the page changed sharply while it was loading.Behaviour in a sandbox
rule:BEHAV_DOM_DENSITY_SPIKE - Most of what the page loaded came from other domains rather than from this one.Behaviour in a sandbox
rule:BEHAV_EXTERNAL_RATIO_HIGH - An external threat feed lists this domain: either Google Safe Browsing marked it malicious, or a significant number of malware engines flagged it.External reputation
rule:EXT_BLACKLIST_CRITICAL
Identity verification
| Status | UNVERIFIED |
|---|---|
| Identity score | 30/100 |
| Identity verification confidence | 50% |
- No on-site identity signals detected
Identity verification measures whether the site can be independently connected to a real-world brand or person. It is separate from the classification confidence.
What TrustSniffer observed
First-party facts recorded during the assessment of nomeudinheiromandoeu.com.br.
- The request stayed on nomeudinheiromandoeu.com.br. It was not redirected to another domain. Clear
- DNS for this domain is served by dns.br, across 2 name servers. Noted
- The registration is paid up to 2026-12-06. Noted
- The earliest public archive of this site is from 2018-05-14. Clear
- It is hosted on AMAZON-02, from a server in BR. Noted
Domain intelligence
| Registrar | Not available |
|---|---|
| Hosting | AMAZON-02 - Amazon.com, Inc., US |
| Country | BR |
| Server IP | 177.71.139.205 |
| Name servers | d.sec.dns.br, f.sec.dns.br |
| SSL issuer | YR1 |
| SSL expiry | 2026-11-17 |
| Domain age | 8.71 years (continuous registration) |
| Domain expiry | 2026-12-06 |
| Archive first seen | 2018-05-14 |
| Archive snapshots | Not counted (archive lookup incomplete) |
| Reputation | VirusTotal: 9 flagged | AbuseIPDB: 0 reports | Google Safe Browsing: 0 matches |
About this assessment
A trust score summarises the evidence TrustSniffer could collect about nomeudinheiromandoeu.com.br at assessment time. It is a starting point for your own judgement, not a guarantee: a high score means the signals were consistent with a legitimately operated site, a low or critical score means several risk patterns were present.
TrustSniffer assesses a website from the evidence it can collect at a point in time: domain registration and age, hosting and certificate, the content the site served, and third-party reputation feeds. A score is a summary of that evidence, not a guarantee and not a legal finding. There is no human rating and no user review in it. A site can change after it is assessed.