# PhishDestroy domain threat record: gleventslive.com.br Content language: English Canonical HTML report: https://phishdestroy.io/domain/gleventslive.com.br/ Machine-readable companion: https://phishdestroy.io/domain/gleventslive.com.br/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-16 00:41:31 UTC - Last availability or vendor check: 2026-10-22 10:42:31 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 - Registration date (registry RDAP, gleventslive.com.br): 2017-09-20 19:17:30 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a14226-c4e7-75cb-86c7-210d8eb7979b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/gleventslive.com.br - Certificate Transparency search: https://crt.sh/?q=%25.gleventslive.com.br - Web Archive lookup: https://web.archive.org/web/*/https://gleventslive.com.br/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview gleventslive.com.br is an impersonation phishing page styled after GL events LIVE, the event-services brand. Its title reads "GL events LIVE - Soluções completas para o seu evento", which marks Portuguese-speaking organizers, corporate clients and suppliers in Brazil as the likely audience. PhishDestroy first flagged the domain on 2026-10-16. As of 2026-10-19 the site was alive and serving content. How the scam works Impersonation pages copy a known company's branding so visitors believe they are dealing with the real business. Here the page presents itself as a provider of complete event solutions under the GL events LIVE name. Schemes of this type typically ask visitors to submit contact and company details, log in to a fake client area, request quotes, or pay invoices and deposits for event services that never arrive. Victims can lose account credentials, personal and business data, and money sent to accounts the scammers control. Evidence On VirusTotal, 4 of 92 engines flagged the domain as of 2026-10-19: Chong Lua Dao, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a low detection count, so many security tools may not yet block the site. The domain appears in 34 AlienVault OTX pulses, which shows it has drawn wider attention from threat researchers. It is also listed on the PhishDestroy blocklist. Infrastructure The domain was registered on 2017-09-20, so it is far older than the date PhishDestroy first flagged it. It resolves to 188.114.96.3 on Cloudflare's network (AS13335), located in the US. That address belongs to Cloudflare's proxy service and hides the origin server. The TLS certificate was issued by Google Trust Services (WE1), so the padlock in the browser says nothing about whether the site is legitimate. What to do If you entered a password on this site, change it at once, along with any account that uses the same password, and turn on two-factor authentication. If you sent payment or banking details, contact your bank or card issuer right away to dispute the transaction and watch for fraud. Reach GL events through contact details you find independently, not through anything on this page, to confirm whether any quote or invoice is genuine. Security teams should block the domain at DNS, proxy and email gateways, search mail logs for messages that link to it, and report it to Cloudflare and the Brazilian registry for takedown. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a14226-c4e7-75cb-86c7-210d8eb7979b/ VirusTotal report: https://www.virustotal.com/gui/domain/gleventslive.com.br Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gleventslive.com.br Archived copy: https://web.archive.org/web/20261016004337/https://gleventslive.com.br/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:22:35 UTC ## Stored page captures - Primary capture: https://i.ibb.co/wNpZkQnT/b6338aa075a2.png Captured: 2026-10-16 00:41:31 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a14226-c4e7-75cb-86c7-210d8eb7979b.png Captured: 2026-10-16 00:41:31 UTC Source report: https://urlscan.io/result/01a14226-c4e7-75cb-86c7-210d8eb7979b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6ae2ec1e-fb2f-4516-a02b-6878f0323dce.png Captured: 2026-10-16 01:19:33 UTC Source report: https://radar.cloudflare.com/scan/6ae2ec1e-fb2f-4516-a02b-6878f0323dce SHA-256: 908eb1a30ae033b24d36370ed2e47e35b6d9f801158169f85fd353ab3e0042e4 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14221-39da-7138-8b1e-8f531f36bcc3.png Captured: 2026-10-16 00:34:07 UTC Source report: https://urlscan.io/result/01a14221-39da-7138-8b1e-8f531f36bcc3/ SHA-256: 87207cda3e3173a2b443cfb653ca9700865f9b834ff3d7f60a8bc40eda869871 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14221-ef9c-7314-a0b5-21e3371fac10.png Captured: 2026-10-16 00:34:54 UTC Source report: https://urlscan.io/result/01a14221-ef9c-7314-a0b5-21e3371fac10/ SHA-256: 57fec87b0b27f7eac7ca6f35293e753de20372e0d6bfcd0ce0d122bcd993caa3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:46:29Z", "uuid": "01a14226-c4e7-75cb-86c7-210d8eb7979b", "scanned_at": "2026-10-16T00:40:28Z", "final_url": "https://gleventslive.com.br/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://gleventslive.com.br/", "from": "http://gleventslive.com.br/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "microfrontends.monday.com", "cdn.monday.com", "fonts.googleapis.com", "forms.monday.com", "fonts.gstatic.com", "d33zzd4k5u0xj2.cloudfront.net", "dapulse-res.cloudinary.com", "informer-cdn.monday.com", "graph.instagram.com", "static.cloudflareinsights.com", "cdnjs.cloudflare.com" ], "ips": [ "18.245.78.197", "23.222.80.49", "52.222.214.7", "99.84.152.118", "157.240.0.63", "104.16.80.73", "104.17.25.14", "99.84.152.38", "142.251.127.94", "104.16.50.19", "142.251.14.95", "188.114.97.3" ], "asns": [ "16509", "16625", "32934", "13335", "15169" ], "countries": [ "US", "DE" ], "link_domains": [ "strglliveprod.z15.web.core.windows.net", "www.facebook.com", "www.instagram.com" ], "social": [ "https://www.facebook.com/GLeventsLiveBr", "https://www.instagram.com/gleventslivebr" ], "doc_hash": "bf2a43f1ccb265f094ebc53be86358889fe5a08a1100ac99776a94c47429eb4c", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "1b34b2b3e3fe1001795124c409463d4986f1479b200f8a9c419b85c208c9137f", "c2ff7e95f783e50041950bb68e3fca6f3ca491c197ad4f435475a4aa29ac050a", "2c72543080d3623bc00e4edd662a43345f1a8503df9d5ccee1d456f78a5a8909", "4e0781bdd2cbb5db04da3b5e059eeca34e325fabb893bee7457b5babf5b7c029", "10dd83101299abc22f9f2d2411fb2cbcec5fc6dd27bde36654e94535b1575d13", "81c4cb0bc57b5cce1816bd704f7a2b12ec2b143c6a067402644d4a139b273350", "b91ea424e1fcb68fec6533eef19b285b9f6e28811d5ee84e61010db44a773d15", "cb40110e8642445001f2e1d8f4bf79570667d2e5b532dac5b09ff96a7a326f96", "d9f7088d9fc16056ad305b2088eb98fd33b5ca6a2e4a9f9b5b8f3c8bbe464712" ], "globals": [ "$", "jQuery", "bootstrap", "WOW", "token", "limit", "url" ], "cookies": [ "cf_clearance", "__cf_bm" ], "tls": { "san": [ "gleventslive.com.br", "*.gleventslive.com.br" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "gleventslive.com.br", "protocol": "QUIC", "valid_to": "2026-12-16T11:18:11Z", "valid_from": "2026-09-17T10:18:27Z" }, "domain_age_days": 3141, "apex_age_days": 3141, "tls_age_days": 28, "tls_valid_days": 90, "requests": 163, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 25, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:59:32Z", "uuid": "6ae2ec1e-fb2f-4516-a02b-6878f0323dce", "scanned_at": "2026-10-16T01:19:33Z", "final_url": "https://gleventslive.com.br/", "status": 200, "history": [ { "url": "https://gleventslive.com.br/", "status": 200 } ], "dom_hash": "7536650a0af1c62f3b2e280d6754480677d62869d3be85c8dfa77fe940104e64", "doc_hash": "a07aa00ff67877fc8c0820434dc86ebbf48d5a44fd0530996635a88b872af410", "domain_risks": [ "Parked & For Sale Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "gleventslive.com.br", "type": "A", "value": "104.21.4.37" }, { "name": "gleventslive.com.br", "type": "A", "value": "172.67.131.158" }, { "name": "gleventslive.com.br", "type": "AAAA", "value": "2606:4700:3037::6815:425" }, { "name": "gleventslive.com.br", "type": "AAAA", "value": "2606:4700:3036::ac43:839e" } ], "dnssec_valid": false, "ip": "104.21.4.37" }, "vt": { "v": 1, "fetched_at": "2026-10-20T19:46:25Z", "analysis_at": "2026-10-20T00:12:09Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 3, "suspicious": 1, "undetected": 33 }, "detections": { "SOCRadar": "malicious", "Gridinsoft": "suspicious", "Chong Lua Dao": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "popularity": { "Alexa": 456216, "Majestic": 141294 }, "expires": "2027-09-20T00:00:00Z", "first_seen": "2023-10-05T13:34:30Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.4.37" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:spf.protection.outlook.com ip4:46.21.148.50 -all" }, { "ttl": 300, "type": "MX", "value": "_dc-mx.1c5544ebf01f.gleventslive.com.br", "priority": 0 }, { "ttl": 300, "type": "A", "value": "172.67.131.158" }, { "ttl": 21600, "type": "NS", "value": "randall.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "gridinsoft-verify=zhvazpwzn43i8txhsn2br59gi3vgfn39dn2enr2a7cx9j41mkqxi51gt3ifciajg" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::ac43:839e" }, { "ttl": 21600, "type": "NS", "value": "irma.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:425" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "irma.ns.cloudflare.com" } ], "dns_at": "2026-10-20T00:12:38Z", "jarm": "27d00040d00040d1dc42d43d00041de892a844a7a3efc0739d1779714fa0b1", "cert": { "san": [ "gleventslive.com.br", "*.gleventslive.com.br" ], "issuer": "Google Trust Services / WE1", "serial": "c6f53f937c48940d13b1c53fd51d5cc8", "sha256": "b8d2c1fb17177f7fcdc3425798a3b6c444f42195d31e75b8f0434a79acea0a0f", "subject": "gleventslive.com.br", "valid_to": "2026-12-16T11:18:11Z", "valid_from": "2026-09-17T10:18:27Z" } } } ```