oknrmtcy[.]gaxlmqrh[.]raiffeisen-lidhje[.]com

The domain oknrmtcy.gaxlmqrh.raiffeisen-lidhje.com was registered on January 20, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and is currently listed as offline. Infrastructure analysis shows the domain resolves to the IP address 15.197.130.221, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The name server set includes ina1.registrar.eu, ina2.registrar.eu, ina3.registrar.eu, ns1.openprovider.nl and ns2.op, indicating a mixed registrar and hosting provider environment. No TLS certificate was observed for the host, meaning the service, when active, would have been delivered over plain HTTP, a common characteristic of credential‑harvesting sites.

Trust scoring from Gridinsoft assigns a zero out of one hundred, reflecting a lack of confidence in the domain’s legitimacy. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal scans recorded fifteen detections out of ninety‑five antivirus and URL‑reputation engines, confirming that multiple independent sensors flagged the domain as malicious. The page title returned by HTTP queries is "raiffeisen-lidhje.com", suggesting an attempt to reference the Raiffeisen brand, although no further branding details are available.

Evidence gaps remain regarding the specific phishing payload, landing‑page content, and any credential‑capture mechanisms, as the site has been taken offline and no archive snapshots have been captured. Defenders should continue to block the domain at DNS and proxy layers, add the observed IP address to network‑level deny lists, and monitor for any future re‑registration attempts that reuse the same name servers or hosting provider. Ongoing vigilance is advised for any traffic targeting the Raiffeisen brand, especially from endpoints that may have previously interacted with this domain before its takedown.