conservrodovias[.]top

This domain is flagged for hosting a fake toll payment portal, a form of brand impersonation phishing designed to harvest financial credentials. Analysis indicates the site mimicked Conserv Manutencao em Rodovias LTDA, a legitimate Brazilian road maintenance entity, under the guise of a digital toll collection system. The threat type aligns with credential theft campaigns targeting users of transportation infrastructure services, where victims are tricked into entering payment details on fraudulent platforms. Infrastructure analysis reveals the domain conservrodovias.top was registered on March 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing domains. It resolved to the IP address 187.110.162.234, geolocated in Brazil under AS53107 (EVEO S.A.). The domain appears on one security blocklist, and VirusTotal reports 18 out of 95 security vendors flagging it as malicious. Notably, the site lacked an SSL certificate, a red flag for user data protection. The page title, Pedágio Digital - Conserv Manutencao em Rodovias LTDA, directly impersonates the legitimate brand, reinforcing the phishing intent. Mitigation steps for this specific threat type include immediate verification of toll payment portals through official government or company websites. Users should avoid entering credentials on any site lacking HTTPS or displaying unusual domain names. Organizations targeted by such impersonation campaigns should monitor for newly registered domains containing their brand names and report them to registrars and security vendors. Network defenders are advised to block the IP 187.110.162.234 and monitor for related domains registered via PublicDomainRegistry.com, particularly those created in close temporal proximity to known phishing events.