europe-north[.]kfenewsa[.]life

Analysis of the domain europe-north.kfenewsa.life indicates it was actively hosting a phishing page impersonating the German news outlet Tagesschau. The page title extracted from the site reads 'STV-Eklat bei Illner: Maybrit bringt Friedrich Merz in Bedrängnis – geheimer Regierungsplan erschüttert Deutschland | tagesschau.de', a fabricated headline designed to lure visitors into engaging with the content. The domain resolved to IP address 172.67.186.136, hosted on Cloudflare infrastructure (AS13335) in the United States, a common pattern for phishing sites leveraging CDN services to obscure their origin. Gridinsoft assigned a trust score of 0 out of 100, reflecting high confidence in malicious classification.

One security vendor flagged the domain on VirusTotal, though the specific detection context remains limited. The domain appears on one security blocklist, and PhishDestroy has already implemented blocking measures. No nameservers were found, suggesting potential takedown efforts or incomplete DNS configuration. The SSL certificate was issued by Google Trust Services (WE1), a legitimate but frequently abused provider for phishing domains.

As of July 24, 2026, the domain is offline, though its infrastructure may reappear under a different name. Defenders should monitor for similar domains using fabricated Tagesschau headlines or Cloudflare-hosted IPs in the 172.67.0.0/16 range. No evidence of credential harvesting or malware delivery was confirmed, but the page title strongly suggests social engineering tactics targeting German-speaking users. Further analysis of the page content is required to determine if additional payloads or redirects were present.