pagina0riginal2026[.]lojavirtualnuvem[.]com[.]br

This domain, pagina0riginal2026.lojavirtualnuvem.com.br, is currently under investigation for hosting a phishing storefront. Analysis indicates the domain was registered on April 30, 2026, and resolves to the IP address 185.133.35.22, located in Brazil and associated with Linked Store Brasil Criacao E Desenvol De Software. The site returns an HTTP 200 status code and displays the page title 'Loja online de home,' suggesting an attempt to mimic a legitimate online retail platform. As of July 12, 2026, the domain remains active and has been flagged on one security blocklist, specifically PhishDestroy, though it has not yet been detected by any of the 95 engines on VirusTotal.

Infrastructure analysis reveals the domain uses an SSL certificate issued by Google Trust Services (WE1), which may lend a superficial appearance of legitimacy. However, the Gridinsoft trust score of 0/100 further supports the classification of this domain as malicious. The combination of a recently registered domain, a generic storefront title, and minimal detection on security platforms suggests this may be an early-stage phishing campaign targeting Portuguese-speaking users. The lack of detections on VirusTotal does not indicate safety, as phishing domains often evade initial scans before gaining broader attention.

Defenders should treat this domain as potentially harmful based on its current blocklist status and the context of its infrastructure. Network-level blocking is recommended for organizations with users who may be targeted by retail-themed phishing attempts. Monitoring for additional detections or changes in the domain's behavior, such as shifts in resolved IP addresses or updated page content, will be critical in determining the full scope of this threat. Given the domain's recent registration and active status, further investigation into its hosting provider and associated infrastructure is warranted to identify potential linked campaigns or threat actors.