atlaspayoptions[.]com

This domain, atlaspayoptions.com, was registered on 22 April 2025 through OwnRegistrar, Inc. and is hosted on the IP address 163.61.188.5, which belongs to ASN 153568 (NEW DHAKA HARDWARE) located in the United States. The site resolves to four LyteHosting name servers (dns1.lytehosting.com through dns4.lytehosting). A Let’s Encrypt R12 certificate was observed for the domain, indicating that TLS was provisioned at the time of analysis. The page title returned by the HTTP response was “Atlas Pay Options”, and the domain is explicitly listed as impersonating Apple.

Security telemetry shows that the domain appears on a single blocklist maintained by PhishDestroy, and one of ninety‑five VirusTotal scanners flagged the host as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the low‑reputation assessment. The domain’s current HTTP status is offline, suggesting that the phishing infrastructure has been taken down or otherwise ceased operation. Evidence confirms that the infrastructure was deliberately configured to target Apple users, but the specific tactics, content, or credential‑harvesting mechanisms employed by the site have not been captured in the available dataset.

Consequently, the exact attack vector and any associated payload remain uncertain. Defenders should continue to block the IP 163.61.188.5 at network perimeters, add atlaspayoptions.com to internal URL filtering and DNS sink‑hole lists, and monitor the registrar OwnRegistrar, Inc. for any new registrations that reuse the same name‑server pattern. Because the domain is already offline, immediate incident response actions are limited to verification that no residual redirects or cached pages remain in corporate proxies. Ongoing surveillance of the AS 153568 prefix is recommended, as threat actors frequently recycle hosting assets within the same autonomous system.