Dear Abuse Response Team,
I am writing to report a serious case of phishing and malicious cloaking involving the following domain:
https://autoescolaauecfc.vercel.app
https://veiculos-onlines-digitais-es.vercel.app/
This site is hosted on Hostinger and utilizes services from Hostgator to mask its activities and facilitate malicious operations targeting users in Brazil.
Details of the abuse: The domain is being used to redirect users—specifically those arriving via Google Ads—to a fraudulent website that clones the official portal of Detran ES (the State Department of Traffic of Espírito Santo, Brazil): https://detran.es.gov.br/
The redirection is executed through a "cloaking" technique, where only users arriving from specific Google Ads search terms—such as:
"Detran ES" "Licenciamento ES" (ES Vehicle Licensing)
—are redirected to the phishing page, while other visitors see seemingly harmless content.
The phishing site mimics the design and content of the official "Licenciamento ES" website in an attempt to steal users' personal and financial information.
Evidence: This behavior can be reproduced by searching for "Detran ES" or "Licenciamento ES" on Google and clicking on the link to the fraudulent domain within the search results.
The site employs cloaking to evade detection by web crawlers and automated security checks.
Request for Action: I respectfully request that you investigate and immediately suspend this domain for violating your terms of service and facilitating criminal activity. This operation poses a serious threat to public safety and is being used to deceive Brazilian citizens and commit fraud.
Please let me know if further evidence is required. I am available to provide additional technical details or demonstrations of the phishing behavior, should it be necessary.
Sincerely, João Silva
