portalminassolucoes[.]com

This domain, portalminassolucoes.com, is identified as a credential harvesting site targeting users of Bubble Assessoria, a despachante automotivo service. The domain is currently offline, though it previously operated as a generic phishing page designed to collect sensitive user credentials under the guise of a legitimate business. Analysis indicates the page title explicitly mimicked Bubble Assessoria - Despachante Automotivo, suggesting an intent to deceive Brazilian automotive service clients or employees. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.96.3, which is part of a network known for hosting malicious content. Detection metrics show the domain was flagged by 6 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain appeared on a single security blocklist and was actively blocked by at least one anti-phishing engine. Technical indicators include the use of Bootstrap for page design, Cloudflare for content delivery and DDoS protection, and HTTP/3 for enhanced performance, all of which are common in phishing infrastructure to evade detection and improve user experience. The domain has since been taken offline, likely due to enforcement actions or abandonment by the threat actor. However, the registration date in 2026 suggests the domain may have been pre-registered for future malicious use, a tactic observed in coordinated phishing campaigns. Organizations and individuals are advised to monitor for similar domains using the Bubble Assessoria brand, particularly those registered through NiceNIC or resolving to the same IP range. Network administrators should block the IP 188.114.96.3 and implement real-time phishing detection rules to prevent access to domains with identical infrastructure patterns. Users who may have interacted with this domain should reset credentials immediately and enable multi-factor authentication on all critical accounts.