grupoidesign[.]com[.]br

Analysis indicates that grupoidesign.com.br is currently flagged as a high‑risk generic phishing infrastructure. The domain was registered on 21 February 2026 and resolves to 191.252.142.127, an address hosted by Locaweb Serviços de Internet S/A in Brazil (AS27715). The web server presents an Apache HTTP Server banner and serves a TLS certificate from Let’s Encrypt (R12). HTTP requests return a 403 Forbidden status with the page title “403 Forbidden”, preventing direct observation of malicious content. The domain appears in fifteen AlienVault OTX pulses and has been listed on two public phishing blocklists (PhishDestroy, PhishingDB). VirusTotal reports nine detections out of ninety‑three scanners, and Gridinsoft assigns a trust score of 0 / 100. Nameserver configuration includes ns1.grupoidesign.com.br and ns2.grupoidesign.com.br, and an MX record points to mx.grupoidesign.com.br. While the exact phishing payload or targeted brand has not been disclosed, the convergence of multiple threat‑intel sources, low trust score, and detection by several security vendors justifies a high‑risk classification. Defensive teams should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and consider adding the address to network‑level deny lists. Continued observation of the IP and any future content changes is advised to capture potential payload evolution.