clubepassagensdescontos[.]com

This domain, clubepassagensdescontos.com, is flagged as a credential theft operation targeting users seeking discounted bus tickets in Brazil. Analysis of the page title, 'Passagens de onibus com melhor preco | Viaja Brasil,' indicates an attempt to impersonate a legitimate travel service provider, likely aiming to harvest login credentials, payment details, or personal information from unsuspecting victims. The infrastructure does not exhibit characteristics of a crypto drainer or advanced malware distribution, focusing instead on social engineering tactics to deceive users into submitting sensitive data. Technical indicators reveal the domain was registered on April 24, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar with a history of hosting suspicious domains. The domain resolves to the IP address 216.150.1.1, which has been associated with prior phishing activity. Despite its recent creation, the domain has already been added to one security blocklist, though it remains unflagged by major detection engines, with a VirusTotal score of 0/95. The site employs a Let's Encrypt SSL certificate, providing a false sense of security, and utilizes modern web technologies such as Node.js, React, Vercel, and Next.js, which are often leveraged to create convincing fake interfaces. Additionally, the presence of Google AdSense suggests an attempt to monetize traffic or lend further legitimacy to the fraudulent site. As of the latest assessment, clubepassagensdescontos.com has been taken offline, likely in response to detection by security systems or manual reporting. However, the risk of reemergence remains, as the domain infrastructure and registration details have not been fully dismantled. Users who may have interacted with the site are advised to monitor financial accounts for unauthorized transactions, reset credentials for any associated services, and verify the authenticity of travel-related communications. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The low detection rate underscores the need for heightened vigilance, as similar campaigns may continue to evade automated defenses.