decorcoiors[.]com

This domain, decorcoiors.com, is flagged as a generic phishing site impersonating a paint and coatings supplier under the brand name Decorcolors. Analysis of the page title, "Tintas e Revestimentos | Decorcolors," indicates an attempt to mimic a legitimate business in the Portuguese-speaking market, likely targeting customers or partners of real paint manufacturers. No specific drainer kit signatures were identified, but the domain exhibits characteristics consistent with credential harvesting or fraudulent transaction pages. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 4/95 security vendors, registration through Fewmoretaps OU d/b/a Trustname.com, and resolution to IP address 172.67.188.123. The domain was created on April 28, 2026, suggesting either a typo-squatting attempt or an intentionally future-dated registration to evade immediate scrutiny. It appears on one security blocklist and holds a Gridinsoft trust score of 0/100. Technologies detected include Google Analytics, Cloudflare Browser Insights, and HTTP/3, which may be leveraged to monitor victim interactions or obfuscate malicious traffic. As of the latest verification, decorcoiors.com has been taken offline, likely due to enforcement actions or hosting provider intervention. The domain is blocked by PhishDestroy and other security mechanisms. Despite its current inactive status, residual risk remains for users who may have interacted with the site prior to takedown. Organizations are advised to monitor for credential reuse attempts, particularly from Portuguese-speaking regions, and to update blocklists with the domain and associated IP. Network defenders should inspect logs for connections to 172.67.188.123 or related Cloudflare-hosted infrastructure during the active period.