attvip[.]mx

This domain, attvip.mx, is flagged as a generic phishing site designed to mimic legitimate privacy notices, a tactic commonly used to deceive users into disclosing sensitive information. Analysis indicates the domain hosts content titled 'Aviso de Privacidad,' a Spanish-language privacy notice, which is frequently exploited in phishing campaigns targeting Spanish-speaking users. While no specific brand impersonation or drainer kit is confirmed, the domain’s structure and content align with credential harvesting schemes, where victims are tricked into entering login details or personal data under false pretenses. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on March 30, 2021, through GoDaddy.com and currently resolves to the IP address 67.217.36.132, hosted on AS22458 (CONVERGEONE HOLDINGS, INC.) in the United States. It is flagged by 11 out of 95 security vendors on VirusTotal, appears on two security blocklists, and is actively blocked by PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious domains, providing minimal assurance of authenticity. The domain’s creation date suggests it has been operational for an extended period, increasing the likelihood of prolonged malicious activity. As of the latest assessment, attvip.mx remains active and poses a high risk to users. While it is blocked by multiple security platforms, the domain’s continued resolution and lack of takedown indicate persistent threats. Users are advised to avoid interacting with this domain, and organizations should implement network-level blocks for 67.217.36.132 and associated indicators. Given the domain’s age and blocklist presence, monitoring for related infrastructure or newly registered lookalike domains is recommended to mitigate further exposure.