guiaservicosautomovel[.]com

This domain, guiaservicosautomovel.com, is flagged as a credential theft operation impersonating automotive service providers. Analysis of the page title 'DESPACHANTE AUTOMOTIVO' and infrastructure suggests an attempt to deceive users into submitting sensitive login credentials or personal information under the guise of legitimate vehicle-related services. No direct association with known crypto drainer kits or brand-specific impersonation (e.g., dealerships or manufacturers) was identified, but the generic phishing framework aligns with credential harvesting tactics observed in similar campaigns.

Technical indicators confirm elevated risk: the domain is detected by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It was registered through NiceNIC International Group Co., Limited on February 21, 2026, an anomalous future date likely indicative of fraudulent activity. The domain resolves to IP address 188.114.97.3, a Cloudflare-hosted endpoint leveraging HTTP/3 and Google Trust Services SSL certificates. It appears on one security blocklist and was proactively blocked by PhishDestroy. Google Safe Browsing status remains unconfirmed but is presumed malicious given the context.

As of the latest assessment, guiaservicosautomovel.com has been taken offline, reducing immediate exposure. However, residual risk persists due to the domain's recent registration anomaly and potential for re-emergence under altered infrastructure. Users who interacted with the site are advised to reset credentials for any associated accounts, particularly those tied to automotive services or financial platforms. Organizations should monitor for related domains registered through the same registrar or resolving to the identified IP range, as these may indicate follow-up campaigns.