rscambui[.]com[.]br

This domain is flagged for elevated risk due to targeted credential theft operations impersonating RS Net, a Brazilian fiber optic internet service provider. Analysis indicates the site presents fraudulent login portals designed to harvest user credentials, likely for account takeover or unauthorized access to ISP services. Infrastructure analysis reveals the domain rscambui.com.br was registered on September 26, 2014, and currently resolves to IP address 82.25.72.201 hosted on AS47583 (Hostinger International Limited, BR). The site uses a Let's Encrypt R12 SSL certificate and displays the page title 'RS Net | Internet Fibra Óptica.' Security telemetry shows 11 out of 95 vendors on VirusTotal flagging the domain, while it appears on two security blocklists (PhishDestroy and PhishingDB). The domain has since been taken offline, but historical activity suggests persistent targeting of Portuguese-speaking users. Organizations and end users should implement the following mitigation measures specific to credential theft threats: (1) Block the domain and associated IP (82.25.72.201) at network perimeter controls, (2) Monitor for credential reuse attempts across corporate systems, particularly for ISP or telecom-related accounts, (3) Deploy multi-factor authentication (MFA) for all internet service accounts to prevent unauthorized access from stolen credentials, (4) Conduct user awareness training highlighting ISP impersonation tactics, including fake fiber optic service portals, and (5) Implement domain monitoring for lookalike variants of legitimate ISP domains, focusing on Brazilian TLDs and fiber optic service branding.