l-iniciarseuatendimento[.]shop

This domain is flagged as a high-risk phishing portal specifically targeting Brazilian citizens through fraudulent CPF (Cadastro de Pessoas Físicas) verification services. Analysis indicates the site masquerades as a legitimate government or financial service under the title 'Consulta CPF - Gratuito,' designed to harvest sensitive personal identification numbers for identity theft, financial fraud, or subsequent credential-stuffing attacks. Infrastructure analysis reveals the domain l-iniciarseuatendimento.shop was registered on May 31, 2026, through Dynadot Inc., a registrar frequently exploited for phishing operations. The site resolves to IP address 88.80.17.203, hosted on AS33837 (Fredrik Holmqvist, SE), a network segment previously associated with malicious activity. Security vendor detection on VirusTotal stands at 14/95, with one confirmed blocklist listing by PhishDestroy. The SSL certificate, issued by Let's Encrypt (YR2), provides minimal trust assurance, as automated certificate issuance is commonly abused by threat actors to lend superficial legitimacy to phishing pages. Mitigation requires immediate blocking of the domain and IP at network perimeter controls. Organizations should update endpoint protection signatures to include the domain hash (seed fdc730) and monitor for outbound connections to 88.80.17.203. Users should be educated to recognize phishing indicators: unsolicited CPF verification requests, mismatched domain names, and grammatical inconsistencies in Portuguese-language pages. Financial institutions and government entities in Brazil are advised to issue public warnings regarding this campaign and implement multi-factor authentication for CPF-related services to reduce the impact of credential compromise.