Not Scanned Is Not Clean: The DANFE Link With No TLD

A Portuguese-language phishing campaign sent DANFE invoice notices to a Brazilian institute; the call-to-action used a single-label (no-TLD) hostname (https://marxcal292e/nf/index.php) that cannot resolve, causing URL reputation engines to return 'notscanned' and allow delivery, yet content analysis (Themis/IRONSCALES) and URL structural analysis flagged credential-harvesting risk and a human resolved it as malicious; a second follow-up message to the same mailbox arrived ~85 minutes later. The report recommends treating 'no verdict' as its own policy outcome, scoring URL structure independently of historical reputation, keeping content/language analysis in triage, and correlating repeat sends before closing reports.