web[.]app-servicos-sefaz-es[.]site

This domain is flagged as an elevated-risk phishing resource targeting users of the Espírito Santo Department of Transit (DETRAN-ES) vehicle services. Analysis indicates the site was designed to mimic official DETRAN-ES portals, specifically presenting a page titled 'Serviços DETRAN-ES Veículos' to deceive visitors into submitting sensitive credentials, including login details and personal identification information. The threat type is classified as generic credential phishing with a focus on government service impersonation, a tactic commonly associated with financial fraud and identity theft operations. Infrastructure analysis reveals the domain was registered on April 27, 2026, through HOSTINGER operations, UAB, a registrar frequently utilized in low-cost hosting environments. The domain resolves to the IP address 82.25.67.229, which has been associated with prior phishing activity. Detection metrics indicate limited but targeted exposure: the domain appears on one security blocklist, while VirusTotal reports 3 out of 95 security vendors flagging it as malicious. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as a high-risk resource. Technologies detected on the server include PHP, LiteSpeed, and Hostinger infrastructure, with HTTP/3 support suggesting an attempt to evade traditional detection mechanisms. Mitigation of this threat requires immediate action from both end users and network administrators. Users who accessed the domain should revoke any credentials entered and monitor associated accounts for unauthorized activity. Network-level protections should include blocking the IP address 82.25.67.229 and implementing DNS-based filtering to prevent resolution of the domain. Organizations are advised to deploy email and web filtering rules to detect and quarantine messages containing links to this domain or similar impersonation attempts. Given the domain's current offline status, continuous monitoring is recommended to identify potential re-emergence under alternative infrastructure or domain names.