ativacao[.]planospagbank[.]com

This domain, ativacao.planospagbank.com, is identified as a banking phishing infrastructure specifically designed to impersonate PagBank, a legitimate financial services provider. Analysis indicates the site functioned as a credential harvesting portal, likely employing a phishing kit to mimic the authentication flow of PagBank’s activation or login pages. The page title, 'PagBank,' directly corresponds to the targeted brand, reinforcing the domain’s fraudulent intent to deceive users into disclosing sensitive financial credentials or personal identification details. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 132.148.176.67, hosted on autonomous system AS26496 (GoDaddy.com, LLC) in the United States. It was registered on February 21, 2026, an unusually future-dated creation that may indicate domain generation algorithm manipulation or data entry anomaly. The domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate, identified as R13, suggests a low-cost or automated issuance process, commonly associated with fraudulent sites. While the domain is not currently listed on Google Safe Browsing, its detection by multiple security engines confirms its malicious classification. As of the latest assessment, ativacao.planospagbank.com has been taken offline, likely following detection and reporting by security platforms. Despite its inactive status, residual risk remains due to potential reuse of infrastructure or targeting of users who may have interacted with the domain prior to takedown. Organizations and users are advised to monitor for residual credential exposure, revoke any compromised authentication tokens, and implement domain-based blocking for this and related subdomains. Continuous vigilance is recommended, as threat actors frequently repurpose or resurrect phishing infrastructure under similar naming conventions.