promopassagembus[.]com

The domain promopassagembus.com has been identified as a phishing site specifically targeting users seeking bus tickets under the guise of offering discounted fares through Viaja Brasil. Analysis confirms this domain operated as a credential and payment harvesting platform, impersonating legitimate bus ticket vendors. The site is currently offline, but prior activity indicates a high-risk threat classification. Infrastructure analysis reveals the domain was registered on April 20, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolved to the IP address 216.150.1.1 and employed a Let's Encrypt SSL certificate to appear legitimate. Security vendors flagged the domain with 17 detections out of 95 on VirusTotal, while Google Safe Browsing specifically marked it for social engineering. The domain appeared on two security blocklists and was blocked by PhishDestroy and InversionDNS. Additional technical indicators include the use of Node.js, React, Vercel, Next.js, HSTS, Google AdSense, and Webpack, suggesting a sophisticated frontend designed to mimic legitimate ticketing platforms. The domain has since been taken offline, but users who may have interacted with it should assume credential and payment information was compromised. Organizations are advised to block the domain and associated IP at the network level, monitor for related phishing campaigns, and educate users on recognizing fraudulent ticketing sites. Security teams should review logs for connections to 216.150.1.1 and the domain promopassagembus.com, particularly in regions where Viaja Brasil operates. If financial data was entered, affected parties should initiate fraud monitoring and consider reissuing payment cards.