quitacaodoeleitor[.]com

Analysis of quitacaodoeleitor.com indicates a confirmed phishing domain targeting Brazilian voters, as evidenced by its page title 'Certidão de Quitação,' which directly references an official voter clearance certificate. The domain was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains active as of July 12, 2026. It resolves to IP address 104.21.49.227 and is protected by Cloudflare, with HTTP/3 and Cloudflare Browser Insights detected as underlying technologies. The SSL certificate is issued by Let's Encrypt. The domain is flagged by 6 of 95 security vendors on VirusTotal and appears on two security blocklists: PhishDestroy and BLP-Malware. Additionally, it has been included in 17 threat intelligence pulses on AlienVault OTX, suggesting broader recognition in the security community. The Gridinsoft trust score of 0/100 further supports its malicious classification. No specific phishing kit or brand impersonation beyond the page title has been confirmed in available data. Defenders should treat this domain as high-risk and block it at the network level, particularly in environments serving Portuguese-speaking users or those interacting with Brazilian electoral systems. Further analysis of the site's content may reveal additional targeting tactics, but current evidence confirms its intent to deceive users seeking official voter documentation.