brilho-gainetra[.]com

Analysis of brilho-gainetra.com as of July 25, 2026 indicates that the domain is actively used for brand impersonation targeting the financial brand argent. The site registers through NETIM SAS, with creation date 29 September 2025 and authoritative nameservers ns1.netim.net, ns2.netim.net, ns3.netim.net. The TLS certificate is issued by Let’s Encrypt (R12), confirming that the site serves content over HTTPS. HTTP requests return status code 200, and the domain resolves to IP address 104.168.101.30, which belongs to AS36352 HostPapa located in the United States.

Google Safe Browsing classifies the site as a social engineering threat, and the domain appears on a single security blocklist, specifically PhishDestroy. VirusTotal reports that 14 of 93 scanning engines flag the domain, reinforcing the suspicion of malicious activity. Independent reputation services assign low trust scores: Scamadviser 26/100 and Gridinsoft 0/100. The page title observed, “Brilho Gainetra | Site oficial de Portugal 2025,” does not reference the impersonated brand, suggesting the landing page may be used as a lure.

The campaign’s risk level is high and the status remains active. Defenders should block DNS resolution for brilho-gainetra.com, add the IP 104.168.101.30 to network deny lists, and ensure that email filters flag any communications referencing the brand argent that originate from this domain or its hosting provider. Continuous monitoring of the domain’s reputation on VirusTotal and Google Safe Browsing is advised, as additional detections may emerge. Because the underlying infrastructure is hosted on a shared provider, further investigation of related subdomains or sibling hosts under the same AS may reveal additional malicious actors.