Dear Abuse Team,

I am writing to report a serious case of phishing and malicious cloaking involving the following domain:

https://autoescolaau.vercel.app

https://onlines-digitais-es.vercel.app/

This site is hosted on Hostinger and uses Hostgator services to mask and facilitate malicious activities targeting users in Brazil.

Abuse details: The domain is being used to redirect users (specifically when accessing via Google Ads) to a fake site that clones the official Detran ES portal (the Espírito Santo State Department of Traffic): https://detran.es.gov.br/

The redirection occurs via a cloaking technique, where only users coming from specific Google Ads sources—such as:

"Detran ES" "Licenciamento ES"

—are redirected to the phishing page, while others see seemingly harmless content.

The phishing site mimics the original design and content of the official Licenciamento ES site in an attempt to steal users' personal and financial information.

Evidence: This behavior can be reproduced by searching for “Detran ES” or “Licenciamento ES” on Google and clicking the fraudulent domain link in the search results.

The site uses cloaking to evade detection by crawlers and automated security checks.

Request for Action: I respectfully request that you investigate and immediately suspend this domain for violating your terms of service and facilitating criminal activity. The operation poses a serious threat to public safety and is being used to deceive Brazilian citizens and commit fraud.

Please let me know if further evidence is required. I am available to provide additional technical details or demonstrations of the phishing behavior if necessary.

Sincerely, João Silva