ccrpedagio[.]click

On July 25, 2026, the domain ccrpedagio.click was examined after being listed by PhishDestroy. The domain was registered on February 27, 2026 through Dynadot LLC and resolves to the IP address 185.158.133.1, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated to Poland. DNS records show the authoritative nameservers alan.ns.cloudflare.com and holly.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. No TLS certificate was observed; the site served HTTP only, which further reduces trust signals. The page title returned by the server is “Pedágio Digital”, suggesting the site may be attempting to pose as a digital toll‑payment portal, although no additional branding or content was captured before the site was taken offline.

The domain appears on a single public blocklist and has been flagged by 13 of 93 security vendors on VirusTotal, reflecting a moderate level of consensus among detection engines. The current status is offline, preventing real‑time analysis of the page content, HTTP response codes, or potential credential‑stealing forms. Consequently, the precise phishing kit or credential‑capture methodology remains unknown. Defenders should treat ccrpedagio.click as a confirmed malicious indicator.

Immediate actions include adding the domain to network‑level blocklists, configuring DNS sinks or firewall rules to drop traffic to 185.158.133.1, and monitoring for any future re‑registration or use of the same IP range. Given the lack of TLS, any attempt to interact with the site would be over clear‑text HTTP, which can be logged for further forensic correlation. Continuous observation of the associated nameservers is advised, as Cloudflare hosting can be repurposed for new malicious campaigns.