centralpedagiodigital[.]info

Analysis of centralpedagiodigital.info shows a short-lived infrastructure used for a crypto‑related phishing campaign. The domain was registered through Vercel Inc. on February 23, 2026 and points to the IP address 216.198.79.1, which is owned by Amazon.com, Inc. (AS16509) and geolocated in the United States. Nameserver delegation to kim.ns.cloudflare.com and roan.ns.cloudflare.com indicates reliance on Cloudflare DNS services. No TLS certificate was observed; the site operated without HTTPS, exposing any traffic to interception.

The page title retrieved before takedown was "Free Flow - Pagamento Automático de Pedágio," suggesting the lure targeted users interested in automated toll payment, but the exact content of the page has not been archived. The campaign was classified as a crypto scam in the supplied intelligence and was blocked by PhishDestroy. VirusTotal scans recorded detections by seven of ninety‑three security vendors, reinforcing the malicious assessment. The domain appears on one external blocklist and was referenced in a single AlienVault OTX pulse, providing additional corroboration of its threat status.

Current status is offline, yet the underlying hosting provider (Amazon) and DNS configuration could be reused for future campaigns. Defenders should immediately add centralpedagiodigital.info to URL filtering and DNS block policies, extend blocks to the associated IP 216.198.79.1, and monitor for re‑registration of the same name or similar Vercel‑hosted domains. Given the lack of HTTPS, outbound traffic to the domain should be denied by default, and any residual connections should be inspected for credential or cryptocurrency wallet data exfiltration. Continuous threat‑intel feeds should be consulted for any reappearance of the domain or related indicators, and incident response teams should be prepared to investigate any user reports that reference the "Free Flow" toll‑payment phrasing, as it remains the only visible lure tied to this operation.