azulviagensbc[.]com[.]br

This domain is flagged as an elevated-risk phishing resource targeting travel and booking service users. Analysis indicates it operates as a credential harvesting and payment fraud platform, leveraging social engineering to mimic legitimate travel portals. The infrastructure is designed to intercept user credentials, payment details, and personal data under the guise of travel booking confirmations or promotional offers. Infrastructure analysis reveals the domain was registered on June 10, 2026, through HSTDOMAINS and currently resolves to IP address 2.57.91.91. It employs a Let's Encrypt SSL certificate for HTTPS encryption, while hosting technologies include Hostinger CDN, Google Analytics, and HTTP/3 protocol support. Security telemetry shows detection by 4 out of 95 engines on VirusTotal and presence in one AlienVault OTX threat pulse. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. The page title 'Parked Domain name on Hostinger DNS system' suggests recent activation or staging, though the underlying infrastructure remains operational for malicious campaigns. Organizations and users should implement immediate mitigation measures to counter this threat. Network-level blocking of 2.57.91.91 and the domain azulviagensbc.com.br is recommended, along with monitoring for SSL connections to Let's Encrypt certificates associated with this infrastructure. Security teams should inspect logs for HTTP/3 traffic patterns and Hostinger CDN requests originating from internal networks. End-user education should emphasize verification of travel booking domains, particularly those requesting credentials or payment details. Given the domain's recent registration date in 2026, temporal analysis of newly created domains with similar patterns may uncover additional related threats.