97ee4[.]catex[.]at

Analysis indicates that the domain 97ee4.catex.at operates as a credential harvesting phishing site, designed to deceive users into submitting sensitive authentication details. This infrastructure mimics legitimate login portals, often impersonating corporate, financial, or cloud service providers to exploit trust. The objective is to capture usernames, passwords, and multi-factor authentication codes, enabling unauthorized access to victim accounts. Such campaigns frequently target enterprise environments, where compromised credentials can lead to data breaches, lateral movement, or further phishing distribution within an organization. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain resolves to the IP address 31.59.121.53, which has been associated with prior phishing campaigns. As of the latest assessment, 17 out of 95 security vendors on VirusTotal have flagged 97ee4.catex.at as malicious, with detections including generic phishing, credential theft, and fraudulent login page classifications. The domain is secured with a Let’s Encrypt SSL certificate, a common tactic among threat actors to create a false sense of legitimacy. While the registrar and creation date remain undisclosed in public records, the active status and detection ratio suggest ongoing operational use in phishing operations. Users who have interacted with 97ee4.catex.at should take immediate remedial action. If credentials were entered, they must be changed across all platforms where the same or similar passwords were used. Multi-factor authentication should be enabled or reviewed for compromise. System scans using updated security tools are recommended to detect potential secondary infections. Organizations should monitor for unauthorized access attempts and consider implementing domain-based email filtering to block further communication from this infrastructure. Network-level blocking of the IP 31.59.121.53 and the domain 97ee4.catex.at is advised to prevent recurrence.