aterasig[.]com

Analysis of the domain aterasig.com, as of July 25, 2026, indicates that it has been utilized for a high-risk credential phishing campaign. The domain was registered through NameCheap, Inc. on November 12, 2025, and employs a SSL certificate issued by Google Trust Services / WE1. The domain resolves to the IP address 172.67.141.41, which is located in the United States and is part of the Cloudflare, Inc. network (AS13335). Cloudflare and HTTP/3 technologies are detected on the domain, suggesting the use of advanced web infrastructure to support the phishing operation. The page title for the domain is 'Atera login — access your account through secure sign-in,' which mimics the login page of a legitimate service, potentially targeting users of the Atera platform.

This domain has been flagged by 16 out of 93 security vendors on VirusTotal, indicating a significant level of suspicion among the security community. Additionally, the domain appears in 15 threat intelligence pulses on AlienVault OTX, further corroborating its malicious nature. The current HTTP status code for the domain is 403, suggesting that the site is either intentionally blocking access or has been taken offline by the hosting provider or domain registrar. Despite this, the domain's presence on multiple blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, underscores the need for continued vigilance.

The Scamadviser trust score for aterasig.com is 1/100, which is an extremely low score and indicative of a high-risk domain. Given the evidence, security defenders should treat this domain as a confirmed phishing site and ensure that it is blocked at the network level to prevent potential credential theft. While the exact content of the site is not available for analysis due to the 403 status, the page title and other indicators strongly suggest that it was designed to capture user credentials.