heartbeatcoaching[.]ch

This domain, heartbeatcoaching.ch, is confirmed to host a fraudulent Smart Parking Solutions portal designed to harvest user credentials and payment information. Analysis indicates the site mimics legitimate parking management platforms, presenting a fabricated login interface that captures entered credentials. The page title Smart Parking Solutions is used to lend credibility to the operation, targeting individuals seeking parking services or management solutions. The threat extends to potential financial fraud, as victims may be prompted to enter payment details under the guise of service registration or fine settlement. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on February 21, 2026, through Omegatech.sc, a registrar frequently associated with high-risk domains. It resolves to the IP address 178.16.55.194, located in the Netherlands under AS202412 (Omegatech LTD), an autonomous system with a history of hosting malicious content. As of the latest assessment, 17 out of 95 security vendors on VirusTotal have flagged the domain as malicious. Additionally, the domain appears on one security blocklist, further corroborating its malicious status. The SSL certificate, issued by Let's Encrypt (serial number E8), provides encrypted connections but does not mitigate the underlying threat, as encryption is commonly exploited by phishing sites to appear legitimate. Users who have visited heartbeatcoaching.ch or interacted with the Smart Parking Solutions portal should take immediate action to mitigate potential compromise. All credentials entered on the site should be considered exposed and must be changed across any other platforms where identical or similar passwords were used. Financial institutions should be notified if payment details were submitted, and affected users are advised to monitor accounts for unauthorized transactions. System scans using updated security tools are recommended to detect any secondary payloads or malware that may have been delivered. Organizations should update their security policies to block the domain and associated IP address, and security teams should review logs for any prior connections to 178.16.55.194 or related infrastructure.