rodovias-br[.]live

Analysis of rodovias-br.live shows a newly registered domain created on July 19, 2026 and hosted by GoDaddy.com, LLC. The domain resolves to IP address 132.148.180.53 and uses GoDaddy’s default nameservers ns67.domaincontrol.com and ns68.domaincontrol.com, a configuration commonly associated with low‑cost or compromised hosting environments. VirusTotal scans have recorded three positive detections out of ninety‑one submitted security vendors, indicating that a minority of scanners have identified malicious behavior. The domain is currently listed on one external security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the suspicion of phishing‑related activity. No public Safe Browsing, Open Threat Exchange, SSL certificate, HTTP status, or page‑title information is available, leaving those vectors unverified at this time. The limited but concrete evidence—recent creation, generic hosting, positive vendor flags, and inclusion on a phishing‑focused blocklist—justifies a high‑risk classification. Defenders should treat rodovias-br.live as hostile, enforce network‑level blocking, monitor DNS queries for the domain and its resolved IP, and consider sandboxing any future payloads that may be delivered from the address. Continuous re‑evaluation is advised, as additional indicators such as SSL deployment or content changes could emerge and further clarify the threat landscape.