guiadecarrosespecialista[.]com

This domain is flagged as an elevated-risk generic phishing threat targeting users through fraudulent automotive guide content. Analysis indicates the infrastructure is designed to deceive visitors into disclosing sensitive information or downloading malicious payloads, with no legitimate business purpose detected. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive registrations. It resolves to IP address 172.67.188.117, a hosting provider commonly used for bulletproof hosting of phishing campaigns. Security vendors on VirusTotal flagged the domain with 4/95 detections, while AlienVault OTX lists it in one threat intelligence pulse. The domain appears on one security blocklist, and its SSL certificate is issued by Let’s Encrypt (serial number E7), a certificate authority often exploited by threat actors to lend false legitimacy to phishing sites. The domain is currently offline, though this status may change if the infrastructure is reactivated. Mitigation steps for this threat type include blocking the domain and its resolving IP (172.67.188.117) at the network perimeter. Security teams should monitor for connections to this IP or domain in proxy logs, endpoint detection and response (EDR) telemetry, and DNS query logs. If the domain reappears, users should be cautioned against entering credentials or downloading files from it, as the site likely employs credential harvesting forms or drive-by download attacks. Organizations should also review registrar policies for NICENIC INTERNATIONAL GROUP CO., LIMITED to assess potential for future abuse and consider preemptive blocking of domains registered through high-risk registrars. SSL inspection tools can be configured to flag or block connections using Let’s Encrypt certificates with serial numbers associated with known phishing campaigns.