mobile-tim[.]brflow[.]com[.]br

Analysis indicates that the domain mobile-tim.brflow.com.br was registered on 20 May 2026 and currently resolves to the IPv4 address 45.60.156.36, which is hosted in the United Kingdom and sits behind a cloud‑based security service. The site presents an HTTPS certificate issued by a publicly trusted authority and returns HTTP 200 for the root path. The page title returned by the server is "Portal TIM", suggesting an attempt to impersonate the TIM telecom brand. Automated scanning on VirusTotal recorded detections by 2 of 91 AV engines, and the domain is listed on at least one public phishing blocklist (PhishDestroy). Additional telemetry shows a Gridinsoft trust score of 0 out of 100 and the presence of common web libraries such as Bootstrap and jQuery. The infrastructure is otherwise typical for a short‑lived phishing host. No further forensic detail about the page content or credential‑harvesting mechanisms is available. Because the domain is actively serving content, is flagged by multiple security sources, and appears to target a well‑known brand, defenders should block network resolution to the domain, add it to URL filtering and email security policies, and monitor for related traffic. Continued observation of the hosting provider and any changes to the DNS records is recommended.