oratoria[.]aktoro[.]com[.]br

The domain oratoria.aktoro.com.br has been identified as a generic_phishing threat, indicating it is part of a phishing campaign designed to deceive users into revealing sensitive information. No specific brand was impersonated, and no known drainer kit was associated with this domain. PhishDestroy's analysis reveals that this domain was created on April 7, 2026, a very recent registration date that often signals malicious intent. It resolves to IP address 216.172.160.200 and uses a Let's Encrypt / R12 SSL certificate, which is commonly abused by phishing sites to appear legitimate.

Technical indicators are strong: VirusTotal reports that 8 out of 95 security vendors flag this domain as malicious, a significant detection rate. The domain is registered through an undisclosed registrar, but its appearance on 1 security blocklist confirms that industry experts have already identified it as a threat. Google Safe Browsing status is not explicitly mentioned in the intelligence, but the elevated risk level and blocklist inclusion underscore its dangerous nature. The page title displayed was "Not Acceptable!", which may indicate a server configuration error or an intentional redirection to evade detection.

Currently, oratoria.aktoro.com.br is offline, having been taken down to prevent further harm. PhishDestroy recommends that users who have interacted with this domain monitor their accounts for unusual activity and change passwords if any credentials were submitted. Despite the takedown, residual risk remains if users have already shared sensitive data. Always verify URLs before entering personal information, and use a security tool that blocks known phishing domains. The elevated risk level means this domain posed a credible threat, and continued vigilance is advised.