whiskymuseum[.]at

This domain, whiskymuseum.at, is flagged as a generic phishing site targeting consumers seeking discounted whiskey products. Analysis indicates the site mimics legitimate retail promotions, likely to harvest payment card details or distribute malware under the guise of limited-time offers. No specific brand impersonation is confirmed, but the page title 'Whiskey - Angebote günstig in Aktion kaufen' suggests a broad targeting of German-speaking users with fraudulent e-commerce tactics. The absence of a known drainer kit signature does not preclude the use of custom or obfuscated skimming scripts. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP 78.46.146.14, hosted on AS24940 (Hetzner Online GmbH) in Germany, a common provider for both legitimate and malicious operations. VirusTotal detection shows 12 of 95 security vendors flagging the domain, with a creation date of February 21, 2026, indicating a likely typo-squatted or lookalike registration. The domain appears on two security blocklists, including PhishDestroy and CryptoFirewall, and employs a Let's Encrypt SSL certificate (serial E7) to feign legitimacy. No Google Safe Browsing (GSB) listing is noted, though this may reflect a lag in propagation. Current status shows the domain as offline, likely due to takedown actions or voluntary suspension by the hosting provider. While the immediate threat is mitigated, residual risk persists for users who may have interacted with the site prior to deactivation. Historical DNS records or cached pages could still expose victims to follow-up attacks, such as credential stuffing or secondary phishing campaigns. Users are advised to verify transaction histories, revoke compromised payment details, and monitor for unauthorized activity. Organizations should update blocklists to include the domain and IP, while security teams may investigate related infrastructure for coordinated threats.