ogw[.]tudopelastartup[.]com[.]br

This domain, ogw.tudopelastartup.com.br, is flagged as a generic phishing site targeting users through a fraudulent logistics management interface. The page title, OGW - Gestão de Transporte, suggests an attempt to impersonate a legitimate transportation or fleet management service, likely aiming to harvest corporate or user credentials. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with common phishing deployment patterns observed in credential theft campaigns. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 72.62.141.12 and is hosted on an Nginx server with HTTP/3 support, a configuration increasingly adopted by threat actors to evade detection and improve performance. The domain was registered on March 03, 2026, through NEWFOLD, with a suspiciously forward-dated creation timestamp that may indicate an attempt to bypass reputation-based filters. Security vendors on VirusTotal flagged the domain with a 3/95 detection ratio, while it appears on four distinct security blocklists, including MetaMask and OISD. The SSL certificate is issued by Let’s Encrypt, a common choice for phishing sites due to its free and automated issuance process. Gridinsoft assigned the domain a trust score of 0/100, reinforcing its malicious classification. As of the latest assessment, ogw.tudopelastartartup.com.br has been taken offline, likely in response to automated takedown requests or hosting provider intervention. However, residual risk persists due to the domain’s registration remaining active and the potential for re-deployment under the same or similar infrastructure. Organizations are advised to monitor for DNS resolution attempts to 72.62.141.12 and block the domain across web gateways, email filters, and endpoint protection systems. Users who accessed the site should assume credential exposure and initiate password resets, particularly for accounts associated with logistics, transportation, or enterprise resource planning systems. Continuous vigilance is recommended, as threat actors frequently re-use infrastructure for subsequent campaigns.