autra-finance[.]com

autra-finance.com is currently offline and has been taken down by the PhishDestroy takedown service. The domain was registered on February 02, 2025 through Atak Domain and resolves to the IPv4 address 198.12.66.123, which belongs to AS36352 HostPapa in the United States. DNS resolution is handled by ns1.host-forest.com and ns2.host-forest.com. No TLS certificate is present, indicating that the site operated without HTTPS. The page title returned by the server is the literal string “autra-finance.com”, and the site is classified as a brand‑impersonation campaign targeting the generic “across” brand.

VirusTotal reports that four of ninety‑five scanning engines flagged the domain as malicious, and the domain appears on a single external blocklist. Independent trust‑rating services assign extremely low credibility scores: Scamadviser rates the site 1 out of 100, and Gridinsoft assigns a score of 0 out of 100. These metrics, combined with the lack of a valid SSL certificate and the presence on a blocklist, reinforce the malicious nature of the infrastructure. Evidence does not reveal the specific phishing kit or the exact content served, and no public snapshots of the landing page are available. Consequently, the precise tactics used to harvest credentials remain unknown.

Defenders should continue to enforce network‑level blocking of the domain name and the associated IP address, add the host‑names to URL filtering policies, and monitor for any resurgence of the domain or related sub‑domains. Because the registrar is Atak Domain, investigators may consider contacting the registrar for additional registration details. Ongoing surveillance of the hosting provider HostPapa for other suspicious domains is also advisable. The combination of multiple vendor detections, blocklist presence, and poor trust scores makes autra-finance.com a high‑confidence malicious indicator that should be treated as an active threat until further remediation is confirmed.