atomarx[.]fans

This domain, atomarx.fans, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login information. Analysis indicates the infrastructure is engineered to mimic legitimate authentication portals, likely targeting users of financial services, social media platforms, or corporate networks. The site employs Vue.js for dynamic content rendering and Nginx as its web server, suggesting a structured approach to replicating interactive login interfaces while maintaining operational efficiency. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 24, 2026, through FewMoreTaps OÜ, a registrar frequently associated with abusive registrations. It resolves to the IP address 94.156.154.176 and is currently flagged by 4 out of 95 security vendors on VirusTotal, including detections from PhishDestroy and OISD. Additionally, atomarx.fans appears on two security blocklists, reinforcing its classification as a confirmed phishing threat. The use of a Let's Encrypt SSL certificate further aligns with common phishing tactics to create a false sense of security for visitors. Users who have interacted with atomarx.fans should take immediate remedial action. Those who entered credentials should assume their accounts are compromised and initiate password resets across all associated services, prioritizing accounts with elevated privileges or financial access. Multi-factor authentication (MFA) should be enabled where available, and any sessions initiated from unrecognized devices should be terminated. System scans using updated security tools are recommended to detect potential secondary infections, such as keyloggers or browser-based malware. Network administrators should block the domain and its associated IP (94.156.154.176) at the perimeter to prevent further exposure within organizational environments.