atmautstrasse[.]autos

This domain, atmautstrasse.autos, is actively engaged in credential harvesting under the guise of a legitimate German automotive service provider. The site presents itself as a reliable partner for vehicle-related services, using localized language and branding to deceive visitors into entering sensitive login credentials or personal information. Analysis indicates the site employs social engineering tactics, including professional design elements and a seemingly trustworthy domain name, to lower user vigilance. The threat primarily targets German-speaking users but may expand to other regions given the domain's generic structure and international registration. Infrastructure analysis reveals several high-risk indicators. The domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains due to its lenient registration policies. It resolves to the IP address 62.60.226.180, which has been linked to previous phishing campaigns in security telemetry. The SSL certificate is issued by Let's Encrypt, a common choice among threat actors to lend a false sense of legitimacy. As of the latest scan, only 2 out of 95 security vendors on VirusTotal flag the domain as malicious, suggesting the campaign is either new or employs evasion techniques to avoid widespread detection. Users who have visited atmautstrasse.autos or entered credentials on the site should take immediate action to mitigate risk. First, disconnect the affected device from the network to prevent potential data exfiltration. Next, change all passwords for accounts that may have been exposed, prioritizing financial, email, and work-related credentials. Enable multi-factor authentication wherever possible to add an additional layer of security. Monitor accounts for unauthorized activity, such as logins from unfamiliar locations or devices, and report any suspicious transactions to the respective service providers. Finally, scan the device using updated security tools to detect and remove any malware that may have been installed during the visit. Organizations should block the domain and IP address at the network level to prevent further access by employees or customers.