invoice[.]aumkv-graz[.]at

Analysis indicates that invoice.aumkv-graz.at is actively serving a credential‑phishing campaign targeting Discord users. The domain resolves to 89.22.120.101, an IP located in Germany and associated with the CloudPit hosting environment, and returns an HTTP 302 redirect. The TLS certificate is issued by Let’s Encrypt (E8), a pattern common to short‑lived malicious sites. Registration is through INWX GmbH using the Austrian registrar, with authoritative name servers ns.inwx.de, ns2.inwx.de, and ns3.inwx.eu. Email delivery is directed to the MX host mail.aumkv-graz.at (priority 0). VirusTotal records show 9 of 91 scanners flag the domain, and the Gridinsoft trust score is 0/100, both indicating malicious intent. The page title is "Discord," matching the declared brand target. Infrastructure analysis reveals the use of multiple third‑party services, including email, search, web assembly, cloud computing, payment processing, ticketing, and captcha solutions, suggesting a layered approach to host phishing forms and evade detection. The domain is already listed on at least one public blocklist and is blocked by PhishDestroy. Its status remains active. Defenders should add the domain and its resolving IP to deny‑list rules, monitor DNS queries for the MX record, and enforce strict outbound filtering for connections to the identified service categories. Continuous re‑evaluation is advised, as the threat actor may modify infrastructure or hosting. Until further evidence is gathered, the domain should be treated as high‑risk and blocked at network perimeter and email gateways.