# PhishDestroy domain threat record: timbrasil5g.com.br Content language: English Canonical HTML report: https://phishdestroy.io/domain/timbrasil5g.com.br/ Machine-readable companion: https://phishdestroy.io/domain/timbrasil5g.com.br/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-05 11:42:34 UTC - Last availability or vendor check: 2026-10-21 22:32:53 UTC - Stored record updated: 2026-10-22 14:24:37 UTC - VirusTotal detections in the stored snapshot: 5/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: wordpress ## Stored infrastructure - Observed IP address: 84.32.84.94 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: BR - Registration date (registry RDAP, timbrasil5g.com.br): 2026-08-25 17:11:32 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0715f-e826-769e-9dae-d0a66633b334/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/timbrasil5g.com.br - Certificate Transparency search: https://crt.sh/?q=%25.timbrasil5g.com.br - Web Archive lookup: https://web.archive.org/web/*/https://timbrasil5g.com.br/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview timbrasil5g.com.br is a phishing domain that borrows the name of TIM Brasil, one of Brazil's largest mobile carriers, and pairs it with a 5G hook to look like an official upgrade or promotion. Its targets are TIM subscribers and other Brazilian mobile users. PhishDestroy first flagged it on 2026-09-05. The site has been offline since 2026-09-07 and was still dead when last checked on 2026-10-19. How the scam works Carrier-impersonation pages of this kind lure visitors with a supposed 5G activation, free upgrade or plan discount, then ask them to confirm their identity. Victims typically hand over their full name, CPF, phone number, account login or payment card details. That data can be used for card fraud, account takeover or SIM-swap attempts against the victim's number. The page title read "Página padrão" (default page), a generic placeholder, while we classified the domain as brand impersonation based on its TIM Brasil 5G naming. Evidence On 2026-09-16, 5 of 89 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a modest count, but the vendors are independent and include both web-filtering and threat-intelligence providers. The domain also appears in 4 AlienVault OTX threat pulses, so other researchers have tracked it separately. It is listed on the PhishDestroy blocklist. Infrastructure The domain was registered on 2026-08-25, eleven days before PhishDestroy detected it. Its short lifespan fits a campaign built to work fast before takedown: it went offline just two days after detection. It was hosted at 84.32.84.94 on Hostinger International Limited's network, with the server located in Lithuania. That is far from the Brazilian audience it targeted, which is common for cheap shared hosting used in disposable phishing setups. What to do If you entered a TIM password or other carrier login on this site, change it immediately through TIM's official app or website and turn on any extra verification it offers. If you submitted card details, call your bank to block the card and dispute unfamiliar charges. If you gave your CPF or phone number, watch for unexpected loss of mobile signal, which can signal a SIM swap. Ask TIM to add a port-out or SIM-change lock to your line. Defenders should block the domain and its IP, and add carrier-themed 5G lookalike domains to their monitoring lists. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0715f-e826-769e-9dae-d0a66633b334/ VirusTotal report: https://www.virustotal.com/gui/domain/timbrasil5g.com.br Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=timbrasil5g.com.br Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:22:39 UTC ## Stored page captures - Primary capture: https://i.ibb.co/FbGbqpYH/38aa82e55d04.png Captured: 2026-09-05 11:42:34 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0715f-e826-769e-9dae-d0a66633b334.png Captured: 2026-09-05 11:42:34 UTC Source report: https://urlscan.io/result/01a0715f-e826-769e-9dae-d0a66633b334/ - URLQuery: https://screenshots.phishdestroy.io/uq/a5daff9b-f9ed-4c4a-b72b-eb59250934ee.png Captured: 2026-09-05 11:46:41 UTC Source report: https://urlquery.net/report/a5daff9b-f9ed-4c4a-b72b-eb59250934ee SHA-256: c1d14aad74cec4aee81a9a4c72cbbcf3980439af7bf73ef2fd9849dd586df1a0 - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a07160-95d8-770f-99e4-a40a6441538e.png Captured: 2026-09-05 11:42:37 UTC Source report: https://urlscan.io/result/01a07160-95d8-770f-99e4-a40a6441538e/ SHA-256: a83a5b84d265bde1d202c2e0df33e5585f4f47e20a68a6cc5c2cbce7b6a70f7e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:49:46Z", "uuid": "01a0715f-e826-769e-9dae-d0a66633b334", "scanned_at": "2026-09-05T11:41:52Z", "final_url": "https://timbrasil5g.com.br/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://timbrasil5g.com.br/", "from": "http://timbrasil5g.com.br/", "status": 307 } ], "ip": "2a02:4780:84:a984:424:ef7f:bd35:f861", "domains": [ "fonts.googleapis.com", "hpanel.hostinger.com", "fonts.gstatic.com", "assets.hostinger.com" ], "ips": [ "192.178.183.94", "2606:4700::6813:9550", "2a00:1450:4001:c1f::5f", "2a02:4780:84:a984:424:ef7f:bd35:f861" ], "asns": [ "15169", "13335", "47583" ], "countries": [ "US", "DE", "CY" ], "link_domains": [ "hpanel.hostinger.com", "support.hostinger.com" ], "doc_hash": "6eb63eabeceac7b9b1a0854d93bd1c4bf0b0ce5b2d51163025a1e0036c3c09bc", "cookies": [ "__cf_bm" ], "tls": { "san": [ "timbrasil5g.com.br", "www.timbrasil5g.com.br" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "timbrasil5g.com.br", "protocol": "TLS 1.3", "valid_to": "2026-11-23T19:52:13Z", "valid_from": "2026-08-25T19:52:14Z" }, "domain_age_days": 2425, "apex_age_days": 2425, "tls_age_days": 10, "tls_valid_days": 89, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -4, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "hcdn", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.3.33", "content-security-policy": "upgrade-insecure-requests" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:00:21Z", "uuid": "b1bd7bfa-fe98-482e-bde3-543043ca10b2", "scanned_at": "2026-09-05T12:21:20Z" } } ```