The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
No phishing signals detected
| URL | hxxps://cmd-autenticacao[.]com/ | |
| Host | cmd-autenticacao[.]com | |
| Screenshot | https://cdn.zerophish.ai/931e0f3e-acc7-4820-b56a-4726c5ef471e.jpg | |
| Scan ID | df060956-d342-4da6-b210-798ba706dbf2 |
No brand impersonation signals available.
| Host | cmd-autenticacao.com |
| Registered domain | cmd-autenticacao.com |
| Scheme | https |
| Content length | 44167 B |
| HTTP | 200 · text/html |
The page is not a login or credential-collection form. It is a Cloudflare-branded block page stating: “Suspected Phishing” and “This website has been reported for potential phishing,” with a disabled “Ignore & Proceed” button, plus a “Learn More” link to Cloudflare documentation.
Because the content is a security interstitial rather than a spoofed brand checkout/login, there are no visible signals of harvesting credentials (no password/OTP fields) and no mismatched branding to a specific third-party. The main suspicious factor is the hosting on a non-matching/unknown domain (cmd-autenticacao.com), but the provided HTML indicates Cloudflare is intercepting.
Overall, treat it as a likely blocked/safety page and label as not phishing based on the evidence shown; however, confidence remains low since the snippet does not show what may exist behind the block or what the legitimate target should be.