10001311[.]dojiner[.]at

This domain, 10001311.dojiner.at, is identified as a credential theft operation designed to impersonate government or institutional login portals. Analysis indicates the site was actively harvesting user credentials through deceptive login interfaces before being taken offline. No specific brand name was recovered from the available metadata, but the infrastructure aligns with patterns observed in government-themed credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through AS214351 (FEMO IT SOLUTIONS LIMITED) on February 21, 2026, and resolved to the IP address 62.60.226.105, located in Germany under the same autonomous system. The domain appears on one security blocklist and is flagged by 22 of 95 security vendors on VirusTotal. Google Safe Browsing has explicitly marked it as a phishing threat. The SSL certificate was issued by Let's Encrypt (R12), a common choice for malicious actors due to its low barrier to entry and short validity periods. The creation date discrepancy suggests potential domain registration timestamp manipulation or future-dated records, a tactic occasionally used to evade detection during initial deployment. The domain is currently offline, but residual risk remains for users who may have interacted with it during its active phase. Organizations and individuals are advised to block the domain and its associated IP (62.60.226.105) at the network perimeter. Users should be alerted to verify the authenticity of any login portal claiming affiliation with government or institutional services, particularly those hosted on non-standard domains. Credential rotation is recommended for any accounts accessed through this domain. Network administrators should monitor for connections to the IP address and domain, as these may indicate compromised endpoints requiring remediation.