portal[.]rodiviasdigital[.]com

This domain, portal.rodiviasdigital.com, is actively engaged in a phishing campaign targeting users of digital toll payment systems in Brazil. Analysis of the page title, 'Pedágio Digital,' indicates the domain is designed to mimic legitimate toll collection platforms, likely to harvest payment card details, login credentials, or personal identification information. The phishing page may present users with fraudulent payment forms, invoices, or authentication prompts, all styled to resemble official toll service providers. Given the high-risk nature of financial phishing, affected users are at immediate risk of fraud, unauthorized transactions, and identity theft. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered through GoDaddy.com, LLC on February 26, 2026, an unusually future-dated creation that may suggest domain spoofing or registry manipulation. It currently resolves to the IP address 64.89.160.8, hosted under AS205759 (Ghosty Networks LLC) in Luxembourg, a network frequently associated with bulletproof hosting services. Detection metrics further confirm its malicious status: the domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal. Additionally, the absence of an SSL certificate increases the risk of data interception during transmission. Users who have visited portal.rodiviasdigital.com or entered sensitive information on the site should take immediate remedial action. First, revoke any credentials or payment details submitted through the domain. Monitor financial statements for unauthorized transactions and report suspicious activity to relevant institutions. Clear browser caches and cookies to remove any residual tracking elements. If authentication tokens or session cookies were exposed, reset passwords for associated accounts, prioritizing those linked to financial services. Organizations should update internal blocklists to include this domain and its resolving IP, while security teams may investigate further using the provided indicators of compromise for threat hunting or incident response.