bmqbeauty[.]com[.]br

Analysis of the domain bmqbeauty.com.br indicates it is actively engaged in generic phishing activity, as evidenced by multiple technical indicators. The domain was registered on October 01, 2025, and remains operational as of August 02, 2026. It resolves to the IP address 192.185.215.66, which has been associated with other suspicious or malicious infrastructure in prior investigations. Infrastructure analysis reveals the domain utilizes nameservers ns28.agenciadimatteo.com.br, ns29.agenciadimatteo.com.br, ns28.prodns.com.br, and ns29.prodns.com.br, suggesting a shared or reseller hosting environment that may facilitate rapid domain deployment for malicious purposes.

Detection data from VirusTotal shows that 3 out of 91 security vendors have flagged bmqbeauty.com.br as malicious, a modest but notable signal given the domain's relatively recent registration. Additionally, the domain appears on at least one security blocklist, specifically PhishDestroy, which further corroborates its classification as a phishing threat. The absence of widespread detection at this stage does not diminish the risk, as phishing domains often evade initial scans before gaining broader attention. The exact nature of the phishing campaign—including the targeted brand, user interaction methods, or payload delivery mechanisms—remains unconfirmed due to limited public analysis of the site's content.

No specific brand or scam category (e.g., financial, retail, or credential harvesting) has been identified in available data. Defenders should treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Organizations are advised to monitor for connections to 192.185.215.66 and the associated nameservers, as these may serve as indicators of compromise (IOCs) for related phishing activity. Further investigation into the hosting provider and registrar may yield additional context regarding the threat actor's infrastructure.