hightechgarage[.]me

This domain, hightechgarage.me, is confirmed as a brand impersonation phishing site targeting the 'across' brand. Analysis indicates the site was designed to mimic legitimate 'across' services, likely to deceive users into divulging sensitive information or interacting with malicious content. No specific drainer kit signatures were identified in available telemetry, but the domain's structure and page title ('High Tech Garage') suggest an attempt to appear as a legitimate technical or retail service associated with the impersonated brand.

Infrastructure analysis reveals the domain was registered through IONOS SE on August 19, 2023, and resolved to the IP address 50.6.7.251, hosted on US-based infrastructure (AS31898 Oracle Corporation). The domain was flagged by 12 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appeared on two security blocklists, including PhishDestroy and PhishingDB, and was secured with a Let's Encrypt SSL certificate (R12). No Google Safe Browsing (GSB) entries were observed in the latest telemetry, though this may reflect the domain's recent takedown rather than prior status.

The domain is currently offline, having been taken down following detection and reporting. While the immediate threat has been mitigated, residual risk remains due to potential reuse of the infrastructure or registration of similar domains. Users who may have interacted with the site are advised to monitor for unauthorized account activity, particularly on platforms associated with the 'across' brand. Organizations should update blocklists to include the domain and IP, and conduct retrospective log analysis to identify any prior interactions with the infrastructure. The elevated risk level is maintained due to the domain's recent activity and the potential for related campaigns to emerge.