rotadigitalflows[.]sbs

This domain, rotadigitalflows.sbs, is identified as a credential theft operation impersonating Pedágio Digital, a digital toll payment platform. Analysis indicates the site was designed to harvest login credentials, payment details, or other sensitive user information under the guise of a legitimate service. The page title, Pedágio Digital, directly mimics the branding of the authentic service, increasing the likelihood of successful deception among targeted users. Technical indicators reveal the domain was registered on February 25, 2026, through Dynadot LLC, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 192.250.227.167, hosted under AS36454 (WHG Hosting Services Ltd) in the United States. At the time of assessment, the domain was flagged by 20 out of 95 security vendors on VirusTotal, with one active entry on security blocklists. Notably, the domain lacks an SSL certificate, a red flag for users expecting encrypted connections on financial or authentication pages. No affiliation with Google Safe Browsing was detected at the time of analysis. The domain has since been taken offline, likely in response to detection and blocking by security systems. However, the infrastructure remains a residual risk, as threat actors may repurpose the IP or registrar for future campaigns. Users who interacted with the domain prior to its takedown should assume credential exposure and initiate password resets, particularly for financial or government-related accounts. Organizations are advised to monitor network logs for connections to 192.250.227.167 and implement domain-based blocking for rotadigitalflows.sbs to prevent residual access attempts.