promopassagensbus[.]com

This domain, promopassagensbus.com, is flagged as a high-risk credential theft operation targeting users of bus ticketing services. Analysis indicates the site impersonates legitimate transportation brands to deceive victims into entering login credentials, payment details, or personal information under the guise of promotional offers or discounted fares. No specific drainer kit signatures were identified, but the infrastructure aligns with known credential harvesting campaigns leveraging fake discount portals. The domain exhibits no direct ties to cryptocurrency theft, focusing instead on traditional financial fraud and identity compromise. Infrastructure analysis reveals concrete technical indicators of malicious activity. The domain resolves to IP address 34.111.179.208, hosted on a US-based cloud provider, and was registered through Fewmoretaps OU d/b/a Trustname.com on April 28, 2026. Security vendors on VirusTotal flagged the domain at a 13/95 detection rate, while Google Safe Browsing explicitly labels it as phishing. The domain appears on one security blocklist, and its SSL certificate, issued by Let's Encrypt (serial number E8), was likely automated to lend superficial legitimacy. The creation date discrepancy (2026) suggests either a typo or deliberate obfuscation of registration timelines. The domain is currently offline, likely taken down due to enforcement actions or hosting provider intervention. However, residual risk persists as threat actors may re-deploy the campaign under a new domain or IP. Users who interacted with the site should immediately reset credentials for any associated accounts, monitor financial statements for unauthorized transactions, and verify the legitimacy of any communications claiming to originate from bus ticketing services. Organizations should update blocklists to include the domain and IP, and conduct internal reviews for potential exposure. The use of cloud hosting and automated SSL certificates underscores the need for continuous monitoring of emerging domains with similar infrastructure patterns.