ATWEU.com Scam Alert: Credential Theft Site Running on Let's

PhishDestroy identifies atweu.com as a credential theft domain actively targeting users through generic phishing lures. No specific brand impersonation or crypto drainer kit has been publicly linked to this domain, suggesting opportunistic harvesting of login credentials via spoofed forms or fake portals. The site likely mimics legitimate services to trick visitors into submitting usernames and passwords, with stolen data potentially routed to attacker-controlled servers. Given the lack of a visible drainer kit or branded impersonation, the attack surface appears broad rather than targeted. This domain resolves to IP 104.21.45.159 and was registered on April 19, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. VirusTotal flags it with a low detection score of 2 out of 95 security vendors, indicating limited awareness in threat feeds. It utilizes a legitimate Let's Encrypt SSL certificate, which may help evade browser warnings. The domain is not currently flagged in Google Safe Browsing (GSB) and has no presence in major public blocklists at this time. atweu.com remains active and poses an elevated risk due to its recent registration and low detection coverage. Users should avoid interacting with the site and report it to their security teams or browser vendors. Security researchers are urged to add the domain and IP to blocklists and monitor for associated infrastructure changes. While the immediate risk is moderate due to low exposure, the domain’s youth and SSL certificate suggest it may be used in longer-term campaigns. Immediate blocking is recommended to prevent credential theft.