suncoastcreditunion[.]at

This domain is flagged as a high-risk phishing site targeting Suncoast Credit Union customers. Analysis indicates the domain is designed to impersonate the official financial institution, likely for credential harvesting or financial fraud. The threat type is classified as generic_phishing, with a focus on deceiving users into submitting sensitive login or personal information. Infrastructure analysis reveals the domain suncoastcreditunion.at resolves to the IP address 45.59.122.205. It is currently offline but was previously detected by 21 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is flagged by Google Safe Browsing for phishing activity. The page title mimics the legitimate site, displaying 'Suncoast Credit Union — Official Suncoast Credit Union Site.' The SSL certificate is issued by Let's Encrypt (YR1), which, while valid, is commonly exploited by malicious actors due to its free and automated issuance process. Mitigation steps include immediate blocking of the domain and its associated IP address (45.59.122.205) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems to prevent access. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window. Financial institutions should monitor for unusual login attempts or transactions linked to this phishing campaign. Proactive measures, such as domain monitoring and user education on identifying phishing attempts, are recommended to reduce future risk.