cadastro[.]art

A newly registered domain, cadastro.art, has been flagged as a phishing site under active use. The domain name suggests a generic registration or verification portal, a common lure for credential harvesting or payment fraud campaigns. No specific brand impersonation or drainer kit signature has been identified in current telemetry, indicating a potentially opportunistic or early-stage campaign targeting unsuspecting users.

Technical analysis reveals several concerning indicators: the domain, registered through HOSTINGER operations (UAB), resolves to IP 35.157.26.135 and utilizes a Let’s Encrypt SSL certificate for legitimacy. The domain was created on March 23, 2026, and currently shows 0 detections across 95 VirusTotal engines. Despite its clean reputation, the domain remains unlisted in Google Safe Browsing (GSB) and has not been added to any major blocklists, leaving it accessible to potential victims.

As of this advisory, cadastro.art remains active and poses an elevated but unquantified risk due to its recent registration and lack of detection coverage. Immediate defensive actions include network-level blocking of the domain and IP, user awareness training to avoid interaction with unsolicited registration links, and continued monitoring for new IOCs. While the current threat level is marked 'under_investigation,' the absence of detections and blocklist coverage suggests this domain could escalate quickly. SOC teams are advised to treat this as a high-priority indicator and prioritize containment to prevent downstream compromise.