at-i[.]cc

This domain, at-i.cc, operates as a credential theft site designed to harvest user login credentials through a fraudulent login portal. Analysis of the page title, 'Log In,' and infrastructure patterns indicates an attempt to mimic legitimate authentication interfaces, likely targeting corporate or financial service users. The site employs social engineering tactics to trick victims into submitting sensitive credentials, which are then exfiltrated to attacker-controlled servers for unauthorized access or financial fraud. Evidence supporting this assessment includes detection by 5 out of 95 security vendors on VirusTotal, with the domain appearing on 3 distinct security blocklists. Infrastructure analysis reveals the domain was registered on December 17, 2024, through NameSilo, LLC, and currently resolves to the IP address 172.67.187.99, hosted on a content delivery network. The SSL certificate, issued by Google Trust Services (WE1), further suggests an attempt to appear legitimate while concealing malicious intent. Users who have visited at-i.cc or entered credentials on the site should immediately revoke any submitted login details by resetting passwords on all associated accounts. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or transactions, and report any anomalies to the respective service providers. If corporate credentials were exposed, notify internal security teams to assess potential lateral movement risks within the network.