og20[.]tudopelastartup[.]com[.]br

This domain, og20.tudopelastartup.com.br, is identified as a fraudulent fleet management login portal targeting corporate users under the guise of 'OG 2.0 - Plataforma de Gestão de Frotas.' Analysis indicates the site was designed to harvest credentials from employees or contractors in logistics, transportation, or fleet operations sectors. The page mimics legitimate fleet management software, increasing the likelihood of successful deception due to its professional appearance and targeted branding. The threat actor likely exploited familiarity with the OG 2.0 brand to trick victims into entering sensitive login details, which could then be used for unauthorized access, financial fraud, or further phishing campaigns within compromised organizations.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 72.62.141.12 and is flagged by 3 out of 95 security vendors on VirusTotal, including detections for generic phishing. It appears on three independent security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. Registered through NEWFOLD on March 03, 2026, the domain was created with a future date, a tactic occasionally used to evade initial scrutiny. The site employed a Let's Encrypt SSL certificate and was built using Node.js, React, Next.js, and Webpack, suggesting a modern, sophisticated phishing kit. Gridinsoft assigned a trust score of 0/100, further confirming its malicious nature.

Users who visited og20.tudopelastartartup.com.br should assume their credentials were compromised. Immediate steps include resetting passwords for any accounts entered on the site, particularly those linked to corporate systems, financial services, or email. Enable multi-factor authentication where available to mitigate unauthorized access. Organizations should review logs for unusual login attempts or data exfiltration from affected accounts. If payment details or sensitive corporate information were submitted, monitor for signs of fraud or identity theft. Report the incident to internal security teams or relevant authorities to assist in tracking the campaign. Avoid interacting with any communications claiming to be from 'OG 2.0' unless verified through official channels.