rede[.]contestacao-venda[.]com

This domain, rede.contestacao-venda.com, is identified as a credential theft phishing operation targeting users through deceptive login portals. Analysis indicates no direct association with known brand impersonation or cryptocurrency drainer kits, suggesting a broader credential harvesting campaign. The page title, 'Cloudflare Tunnel error,' may have been leveraged to mislead users into believing technical issues were present, potentially lowering their guard during interaction with the malicious site. Infrastructure analysis reveals the domain was registered on November 2, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted under AS13335 (Cloudflare, Inc.). Detection metrics show the domain is flagged by 17 out of 95 security vendors on VirusTotal, with appearances on two additional security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend legitimacy to malicious domains. No listings were found in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown actions by security providers or the registrar. However, the elevated risk persists due to the domain's recent creation and historical use in credential theft campaigns. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.