swisspost[.]quittung23170[.]live

Analysis of swisspost.quittung23170.live, observed on 23 July 2026, classifies the domain as a generic phishing infrastructure with an elevated risk rating. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on 28 October 2025. DNS resolution points to the IPv6 address 2606:4700:3032::ac43:d9d4, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated to the United States. Cloudflare’s edge network provides the authoritative name servers lana.ns.cloudflare.com and paul.ns.cloudflare.com. No TLS certificate is presented for the host, indicating that HTTPS is not configured.

The domain currently reports an offline status, and it has been removed from active service. Reputation data shows that the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal scans have recorded 16 positive detections out of 95 submitted security vendors, underscoring a consensus among scanners that the site is malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment.

Because the site is offline, direct probing is not possible, and the precise content of the web page remains unverified. However, the combination of registrar behavior, Cloudflare hosting, lack of encryption, and multiple vendor detections provides sufficient evidence for security teams to treat the domain as hostile. Defensive measures should include adding the domain to local blocklists, configuring network firewalls to drop traffic to the associated IPv6 address, and updating intrusion‑prevention signatures that reference the observed identifiers. Continuous monitoring of the registrar and Cloudflare IP range for new domains with similar characteristics is recommended to pre‑empt future campaigns that may reuse this infrastructure.