wombatscitymunichhauptbahnhof[.]hostel[.]town

This domain, wombatscitymunichhauptbahnhof.hostel.town, is flagged as a credential phishing operation targeting users of the legitimate Wombat’s City Hostel Munich Hauptbahnhof. Analysis indicates the site mimics the hostel’s booking interface to harvest login credentials, payment details, and personal information. No drainer kit signatures were identified, but the presence of WordPress, MySQL, and PHP suggests a templated phishing framework designed for rapid deployment and scalability. The page title, "Wombat'S City Hostel Munich Hauptbahnhof - Munich, Germany," directly matches the legitimate hostel’s branding, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals the domain resolves to the IP address 172.86.104.14 and was registered through Spaceship, Inc. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The domain’s trust score is 0/100, and it is currently classified as offline. The SSL certificate was issued by ZeroSSL GmbH, a provider commonly used in both legitimate and malicious deployments. No entries were found in Google Safe Browsing at the time of analysis, though this may reflect a lag in detection rather than absence of risk. The domain has been taken offline, likely in response to abuse reports or automated takedown mechanisms. However, the underlying infrastructure remains a concern, as the IP address and registrar have been associated with prior phishing campaigns. Users who interacted with the domain should assume credential compromise and initiate password resets, particularly for accounts linked to travel or financial services. Organizations are advised to monitor for similar domains registered under the same registrar or resolving to the same IP range, as threat actors may reuse infrastructure for future campaigns.