frstore[.]rumahsakit[.]de

This domain, frstore.rumahsakit.de, is currently active and flagged as a high-risk phishing site. Infrastructure analysis reveals it resolves to IP address 103.52.114.215 and uses Cloudflare nameservers (aldo.ns.cloudflare.com and pat.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. As of July 17, 2026, twelve of ninety-one security vendors on VirusTotal have detected this domain as malicious, indicating confirmed phishing activity. The specific brand or service being impersonated is not yet confirmed in available data, and no page content analysis has been performed to determine the exact phishing lure or target demographic. Defenders should treat this domain as hostile and implement blocking at the DNS or network level. Monitoring for related subdomains or IP associations is recommended, as this infrastructure may be reused for additional campaigns. No registration or kit details are currently available to assess the actor or tooling behind this operation.