atlasdao[.]app

This domain is flagged as a PIX payment gateway phishing site targeting merchants and financial transactions. Analysis indicates an elevated risk level due to its specific focus on fraudulent payment processing under the guise of a legitimate payment service. The domain was designed to mimic authentic PIX gateway interfaces, likely to harvest credentials, payment details, or execute unauthorized transactions. Infrastructure analysis reveals the domain was registered through Namecheap Inc and resolves to the IP address 45.38.20.7. Security vendor detections on VirusTotal stand at 4/95, while it appears on four distinct security blocklists, including MetaMask, PhishDestroy, SEAL, and OISD. AlienVault OTX records the domain in two threat intelligence pulses, and Gridinsoft assigns a trust score of 0/100. The site employed Node.js, React, Next.js, HSTS, Webpack, and HTTP/3, with a Let's Encrypt SSL certificate, suggesting an attempt to appear technically legitimate while concealing malicious intent. Mitigation steps for this threat type include immediate blocking of the domain and associated IP at firewall and DNS levels. Network administrators should monitor for connections to 45.38.20.7 and review logs for any prior interactions with atlasdao.app. Financial institutions and payment processors should alert merchants about this phishing campaign, particularly those using PIX gateways, and advise verification of payment portals through official channels. End-users should be trained to recognize phishing indicators, such as mismatched URLs, unsolicited payment requests, and unofficial SSL certificates, even when domains appear to use modern web technologies.