pedagiofflowbrasil[.]shop

This domain, pedagiofflowbrasil.shop, is identified as a phishing site impersonating an official Brazilian toll payment portal branded as 'Pedágio Digital.' The site presents itself as a legitimate platform for users to consult and pay toll debts online, targeting Portuguese-speaking users likely in Brazil. Analysis indicates the domain is designed to harvest sensitive financial information, including payment card details and personal identification, under the guise of processing toll fee settlements. The fraudulent nature of this site is further evidenced by its deceptive interface, which closely mimics authentic government or financial service portals to lower user suspicion. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on June 9, 2026, through Dynadot Inc., a registrar frequently associated with malicious domains due to its accessibility and low-cost registration options. It resolves to the IP address 88.80.17.203, which has been linked to other phishing campaigns in recent months. The domain appears on one security blocklist and is flagged by 19 out of 95 security vendors on VirusTotal, including detections for generic phishing and brand impersonation threats. Additionally, the site uses a Let's Encrypt SSL certificate, which, while providing encryption, is commonly exploited by threat actors to lend a false sense of legitimacy to phishing pages. Users who have visited pedagiofflowbrasil.shop or entered any credentials or payment information on the site should take immediate action to mitigate potential risks. First, all passwords or financial details entered on the site should be considered compromised and changed immediately across all platforms where they may have been reused. Affected users are advised to monitor their financial statements for unauthorized transactions and report any suspicious activity to their financial institution. If payment card details were submitted, users should contact their card issuer to request a replacement card. Additionally, running a full antivirus scan on any device used to access the site is recommended to detect potential malware infections. Users should also enable multi-factor authentication on all critical accounts to prevent unauthorized access, even if credentials were exposed.