attarhouse[.]cl

Attarhouse.cl was first observed on March 23, 2026 and is currently active. The domain resolves to the IP address 185.199.108.153, which belongs to the United States and is associated with GitHub, Inc. Registration records indicate the domain was provisioned through GitHub’s registration service. The site presents a TLS certificate issued by Let’s Encrypt (R12) and returns an HTTP 308 permanent redirect status.

The landing page title reads “Attar House | Perfumería Árabe y Decants en Valdivia”, suggesting a retail storefront that mimics a legitimate e‑commerce operation. The use of a generic commercial theme combined with the high‑risk classification aligns with an e‑commerce phishing campaign designed to harvest credentials or payment information from unsuspecting shoppers.

Threat intelligence sources corroborate the malicious intent. AlienVault OTX includes the domain in two separate pulses, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have listed it as hostile. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 2 of 95 scanned security vendors flag the domain, indicating at least some detection of malicious components. The cumulative evidence supports a high‑risk rating.

Defenders should immediately block attarhouse.cl at network perimeter and DNS resolvers, and add the associated IP 185.199.108.153 to host‑based deny lists. Continuous monitoring for any new subdomains or changes in the TLS certificate is advised. Analysts should retrieve the full page content for forensic analysis to confirm the phishing payload and to support attribution efforts.