ultimoleilaohoje[.]cfd

Analysis of the domain ultimoleilaohoje.cfd indicates it was a phishing site targeting Portuguese-speaking users under the guise of GS Supplements Brasil. The domain, registered on November 26, 2025, through Dynadot LLC, resolved to the IP address 34.174.176.130, hosted on Google LLC's infrastructure (AS396982) in the United States. The page title, 'Preferências de Cookies - GS Supplements Brasil,' suggests an attempt to mimic a legitimate cookie consent page for the GS Supplements brand, though no direct evidence confirms whether this was part of a credential harvesting, payment fraud, or other malicious scheme. The domain was flagged by 11 of 95 security vendors on VirusTotal, indicating detection by multiple threat intelligence sources.

It appeared on at least one security blocklist and was blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious. No SSL certificate was present, which is atypical for legitimate e-commerce or brand sites. The domain's nameservers (ns1.siteground.net and ns2.siteground.net) are associated with a hosting provider often used by both legitimate and malicious actors, providing no definitive attribution.

As of July 24, 2026, the domain is offline, though its infrastructure remains a potential indicator of compromise. Defenders should treat this domain as part of a broader phishing campaign targeting the GS Supplements brand or its customers. Historical DNS and WHOIS records should be preserved for further investigation, and security teams are advised to monitor for re-registration or re-emergence of similar domains using the same hosting patterns or naming conventions. No evidence links this domain to a specific phishing kit or advanced persistent threat group, and the exact payload or redirection behavior remains unconfirmed due to the site's current offline status.