strabe-at[.]autos

This domain, strabe-at.autos, is actively engaged in credential theft through the impersonation of a legitimate automotive service provider. The site presents itself as a trusted partner under the guise of a German-language business, using the page title 'strabe-at – strabe-at – Ihr zuverlässiger Partner,' which translates to a claim of reliability. Analysis indicates the domain is designed to harvest login credentials, payment details, or other sensitive information from visitors who mistake it for an authentic automotive or logistics service provider. The use of localized branding and professional presentation increases the likelihood of successful deception, particularly among users seeking automotive-related services or support. Infrastructure analysis reveals the domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 62.60.226.180, which has not yet been widely flagged by security vendors, as evidenced by 0 detections out of 95 on VirusTotal. Despite this low detection rate, the domain appears on one security blocklist, suggesting early-stage identification by at least one threat intelligence source. AlienVault OTX also lists the domain in a single threat intelligence pulse, further corroborating its malicious intent. The discrepancy between the creation date (2026) and current year suggests either a typo in registration records or an attempt to obscure the domain's true age, a tactic occasionally employed to evade detection. Users who have visited strabe-at.autos or interacted with its content should take immediate remedial action. Those who entered credentials or financial information should assume compromise and initiate password resets for all accounts where the same credentials were reused. Financial institutions should be notified if payment details were provided. System scans using updated security tools are recommended to detect any secondary payloads or malware. Organizations should block the domain and its associated IP (62.60.226.180) at the network level to prevent further access. Given the domain's active status and low detection rate, heightened vigilance is advised, particularly among users in German-speaking regions or those engaged in automotive-related transactions.