coloradooutono[.]com

PhishDestroy has identified coloradooutono.com as a generic phishing domain engaged in credential theft, impersonating a Brazilian CPF (Cadastro de Pessoas Físicas) consultation service to steal sensitive personal information. The domain, which resolves to IP address 104.21.58.200, is currently offline but remains a threat due to potential reactivation. The domain was created on October 30, 2025, and registered through Internet Domain Service BS Corp., a registrar often associated with low-quality or malicious domains.

During analysis, the domain's page title was found to be "Consulte seu CPF agora," a classic lure for credential harvesting. VirusTotal flagged it with 7 out of 95 security vendors, indicating moderate detection but significant evasion capability. It appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (R13), a free certificate provider commonly used by both legitimate and malicious sites. The combination of a newly created domain, untrustworthy registrar, and targeted phishing content strongly suggests this domain was built for phishing campaigns.

Given the elevated risk level, PhishDestroy recommends that users who may have interacted with coloradooutono.com change any credentials entered immediately and monitor for identity theft. Organizations should block the domain and IP 104.21.58.200 at the network level, and educate users about credential phishing tactics, especially those targeting Brazilian CPF services. Continuous monitoring is advised as such domains often reappear under different names.