aquabera[.]co

On July 22 2026, the domain aquabera.co was observed hosting a generic phishing page that presents the browser title “Nur einen Moment…”. The site is currently offline, and no SSL certificate is configured for the domain, meaning traffic is not protected by HTTPS. Registration data show the domain was created on 19 May 2025 through NameSilo, LLC, and it resolves to the IP address 104.21.80.1, which belongs to Cloudflare, Inc. (AS13335) located in the United States. The domain’s authoritative name servers are dee.ns.cloudflare.com and miles.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

VirusTotal reports indicate that the domain has been scanned by 95 security vendors, none of which currently flag it as malicious. Independent reputation services provide low trust scores: Scamadviser rates the site at 35 out of 100, and Gridinsoft assigns a score of 0 out of 100. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy, suggesting that at least one anti‑phishing feed has identified it as malicious. Because the domain is offline, active verification of the page content is not possible, and no additional intelligence such as the targeted brand, credential‑stealing kit, or specific phishing technique has been published.

The lack of an SSL certificate, combined with the low reputation scores and blocklist inclusion, raises a high likelihood that the site was used for credential‑phishing or similar fraudulent activity. Defenders should continue to monitor the domain for any re‑appearance, enforce outbound traffic filtering to block connections to 104.21.80.1, and include the domain in internal blocklists. Organizations using web filtering or DNS‑based protection should ensure the domain is denied, and incident response teams should treat any emails or messages referencing aquabera.co as suspicious until further verification.