au-club[.]top

This domain, au-club.top, is a credential theft operation designed to harvest secure PINs and login credentials from unsuspecting users. The site presents itself as a legitimate group login portal, using the deceptive page title 'Group Login · Secure PIN' to trick visitors into entering sensitive authentication details. Credential theft schemes like this are particularly dangerous because they often target financial or corporate accounts, enabling attackers to bypass multi-factor authentication or gain unauthorized access to restricted systems. The use of 'Secure PIN' in the title suggests a focus on high-value targets, such as banking, payment platforms, or enterprise access portals, where PIN-based authentication is common. Analysis indicates that au-club.top is a confirmed malicious domain with multiple technical indicators supporting its fraudulent nature. The domain was registered on February 21, 2026, through NameSilo, LLC, a registrar frequently associated with abusive domains due to its low-cost and minimal verification processes. It resolves to the IP address 154.89.152.9, hosted on AS139923 (ABCCLOUD SDN.BHD.) in Malaysia, a network segment with a history of hosting phishing and malware distribution infrastructure. The domain is flagged by 18 out of 95 security vendors on VirusTotal, including reputable threat intelligence sources such as PhishDestroy and CryptoFirewall. Additionally, the absence of an SSL certificate further confirms its lack of legitimacy, as modern secure login portals universally employ encryption to protect user data in transit. If you or someone in your organization visited au-club.top and entered any credentials, immediate action is required to mitigate the risk of account compromise. First, change the passwords or PINs for any accounts that may have been exposed, prioritizing financial, email, and corporate systems. Enable multi-factor authentication (MFA) on all critical accounts if not already active, and monitor these accounts for unauthorized access or suspicious transactions. Notify your organization’s security team or IT department to conduct a thorough review of network logs for signs of lateral movement or data exfiltration. If the compromised credentials were used for corporate access, consider isolating the affected device from the network until a forensic analysis can be performed. Finally, report the incident to relevant authorities or cybersecurity response teams to contribute to broader threat intelligence efforts and help prevent further victimization.