Dear Abuse Team,
I am writing to report a serious case of phishing and malicious cloaking involving the following domain:
This website is hosted via GoDaddy and is using Cloudflare’s services to mask and facilitate malicious activity targeting users in Brazil.
Details of the Abuse:
The domain is being used to redirect users (specifically when accessed via Google Ads) to a fake website that clones the official portal of ( Detran MT ) especific in ( Brazil):
https://www.detran.mt.gov.br/
The redirection occurs through a cloaking technique, where only users coming from specific Google Ads terms such as:
“Detran MT”
“Licenciamento MT”
are redirected to the phishing page, while others see seemingly benign content.
The phishing site mimics the original design and content of the official Licenciamento MT website in an attempt to steal personal and financial information from users.
Evidence:
This behavior can be reproduced by searching for “Detran MT” or “Licenciamento MT” on Google and clicking on the fraudulent domain’s link in the search results.
The site performs cloaking to avoid detection by crawlers and automated security checks.
Request for Action:
I respectfully request that you investigate and suspend this domain immediately for violating your terms of service and facilitating criminal activity. The operation poses a serious threat to the public and is being used to deceive Brazilian citizens and commit fraud.
Please let me know if additional evidence is needed. I am available to provide further technical details or reproductions of the phishing behavior if necessary.
Sincerely,
Joao Silva