brimetwell[.]com

Analysis of brimetwell.com indicates that the domain is actively used for phishing. The domain was registered on July 30, 2026 through Global Domain Group LLC and currently resolves to the IP address 172.67.179.16, which is hosted by Cloudflare as indicated by the authoritative nameservers bart.ns.cloudflare.com and gina.ns.cloudflare.com. The site is listed on one security blocklist and has been blocked by the PhishDestroy sinkhole, confirming malicious intent.

VirusTotal records show that the domain was submitted to 91 scanning engines, none of which returned a detection at the time of analysis; the absence of detections does not imply benign behavior. No additional intelligence such as page title, SSL certificate details, or HTTP response codes has been published, leaving the exact content of the landing page unverified. The limited age of the domain—less than a week old at the time of reporting—combined with its rapid appearance on a blocklist suggests a campaign that is still in its initial deployment phase.

Defenders should add the domain to local deny lists, monitor DNS queries for the IP 172.67.179.16, and enforce outbound filtering for traffic to Cloudflare‑hosted domains that lack a known business justification. Continuous re‑scanning with multi‑engine services is recommended to capture any future payloads or changes in the site’s behavior. Until further forensic evidence is obtained, the domain should be treated as a high‑confidence phishing indicator.