attesim[.]us

The domain attesim.us is currently active and hosts a web page titled ATTeSIM that returns HTTP 200. The site uses a Let’s Encrypt certificate (E8) and is served by an Apache HTTP Server front‑end with a Node.js/Express application running on a CentOS host. Infrastructure analysis shows the domain resolves to IP 107.21.229.127, an AWS EC2 instance located in the US (us‑east‑1). Registration data indicates the domain was created on 13 September 2023 through GoDaddy.com, LLC, and is managed by the nameservers ns25.domaincontrol.com and ns26.domaincontrol.com. Reputation signals are poor: the domain appears on one security blocklist, Scamadviser assigns a trust score of 15 / 100, Gridinsoft scores 0 / 100, and VirusTotal records 15 detections out of 91 scanning engines. MX records point to Google’s mail infrastructure (aspmx.l.google.com and alt1.as...). PhishDestroy has already blocked the domain. While the page title is known, the specific content and credential‑harvesting mechanisms have not been publicly disclosed. Defenders should block the domain and its associated IP address at perimeter devices, monitor DNS queries for the domain and its nameservers, and include the observed MX configuration in email security policies. Ongoing observation is advised to detect any changes in hosting or content that could affect threat posture.