passagembarata2026[.]com

This domain is flagged as an elevated-risk phishing operation specializing in fake bus ticket sales, targeting Portuguese-speaking users under the false pretense of offering discounted travel. Analysis indicates the site mimics legitimate booking platforms by presenting itself as "Viaja Brasil" with the page title "Passagens de onibus com melhor preco | Viaja Brasil," while harvesting sensitive financial information through deceptive payment forms. Infrastructure analysis reveals multiple high-risk indicators: the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com and resolves to IP address 216.150.1.1. It appears on one security blocklist and is actively blocked by PhishDestroy. The site employs modern web technologies including Node.js, React, Vercel, Next.js, HSTS, Google AdSense integration, and Webpack, while using a Let's Encrypt SSL certificate for apparent legitimacy. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 2/95 security vendors flagging this domain as malicious. Mitigation requires immediate action from both users and network administrators. Users should verify all travel booking domains through official sources and never enter payment details on untrusted platforms. Network administrators should implement DNS filtering to block 216.150.1.1 and domains registered through Fewmoretaps OU, while monitoring for similar patterns including Let's Encrypt certificates on recently created domains with travel-related content. Financial institutions should flag transactions referencing "Viaja Brasil" or this domain for potential fraud review. The combination of modern web stack with recent domain registration and low trust scores represents a classic phishing infrastructure pattern requiring heightened vigilance.