clickbrus[.]com

The domain clickbrus.com is identified as a credential theft phishing operation impersonating the legitimate travel booking service Viagem Certa. Analysis indicates the site was designed to harvest user login credentials, payment details, and personal information under the guise of offering bus ticket purchases. The domain is currently offline, but prior activity confirms its malicious intent. Infrastructure analysis reveals the domain was registered through Fewmoretaps OU d/b/a Trustname.com on April 14, 2026, and resolved to the IP address 34.111.179.208. It was flagged by 15 of 95 security vendors on VirusTotal, appears on 2 independent security blocklists, and has a Gridinsoft trust score of 0/100. The site employed technologies including Node.js, React, Next.js, and Google Cloud infrastructure, with a Let’s Encrypt SSL certificate. It was also referenced in one AlienVault OTX threat intelligence pulse and blocked by PhishDestroy and InversionDNS. While the domain is currently offline, users who may have interacted with it should assume credentials or payment details were compromised. It is recommended to monitor financial statements for unauthorized transactions, reset passwords for any accounts accessed during the exposure window, and enable multi-factor authentication on critical services. Organizations should update security filters to block the domain and associated IP address to prevent future access attempts.