CERT-AGID Warns of Phishing Site Stealing Italian Drivers’ Data
Summary
CERT-AGID says a typosquatted site impersonating Il Portale dell’Automobilista ranked second in Google results and stole tax-code and driver’s-license details; it requested a takedown and alerted Google and the transport ministry.
Key points
- CERT-AGID identified a phishing site at illportaledelautomobilista[.]org that impersonates Italy’s Il Portale dell’Automobilista using a lookalike domain.
- The site reportedly appeared second in Google results for searches for the official portal.
- The imitation page asks for a tax code, driver’s-license number and license expiration date, then displays a false “Data not found” message.
- CERT-AGID says the submitted information is stolen and could support identity theft and follow-up phishing.
- CERT-AGID distributed indicators to accredited public administrations, requested a domain takedown, reported the site to Google and informed the transport ministry.
Article Details
- Event Type
- Phishing campaign impersonating Il Portale dell’Automobilista to steal personal and driver’s-license information.
- Impact
- The fake site appeared as the second Google result for searches for the portal and collected users’ tax codes, driver’s-license numbers, and license expiration dates. The article says the stolen data could enable identity theft and more convincing follow-up phishing. CERT-AGID requested a domain takedown, reported the site to Google, and informed the Ministry of Infrastructure and Transport.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | illportaledelautomobilista[.]org | Typosquatted phishing domain hosting the fake portal and collecting personal and driver’s-license information. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe fake page imitates the legitimate portal’s name, layout, logos, and menus.T1056.002 · GUI Input CaptureA form on the fraudulent page captures tax codes, driver’s-license numbers, and expiration dates entered by users.T1583.001 · DomainsThe article identifies the typosquatted domain as infrastructure used to host the fake portal.
Vendors
Products
Google SearchCERT-AGID identified a phishing campaign that impersonates “Il Portale dell’Automobilista” through the typosquatted domain illportaledelautomobilista[.]org, which appears prominently in Google search results.Il Portale dell’AutomobilistaCERT-AGID identified a phishing campaign that impersonates “Il Portale dell’Automobilista” through the typosquatted domain illportaledelautomobilista[.]org, which appears prominently in Google search results.