Phishing- und Sicherheitsprüfung für digitalprocurements.com

Analysis shows digitalprocurements.com is currently offline, returning a 404 page titled “404 - Quick Tip | Cofense”. The domain resolves to 52.204.246.179, an AWS EC2 instance in the us‑east‑1 region, and is served over HTTPS with a publicly trusted Let’s Encrypt certificate that enforces HSTS. Registration occurred on June 12 2017 through MarkMonitor, Inc., and the authoritative name servers are ns‑1019.awsdns‑63.net, ns‑132.awsdns‑16.com, ns‑1497.awsdns‑59.org and ns‑1585.awsdns‑?.

The MX record points to mx0.us.cf-ops.net with priority 10. VirusTotal scans have flagged the domain in 14 of 94 security engines, and it appears on one public blocklist, notably PhishDestroy, indicating prior malicious use. The limited public evidence suggests the site was used for a generic phishing campaign, but the exact payload, target brand, or credential‑harvesting pages cannot be confirmed because the host now serves only a 404 error.

Uncertainty remains regarding active infrastructure, any remaining C2 endpoints, and whether the domain may be re‑activated. Defenders should proactively block the domain and its resolved IP at DNS and network layers, add the MX host to email security deny lists, enforce TLS inspection to detect any future traffic, and continue monitoring for re‑registration or related sub‑domains. Ongoing threat intel feeds should be queried for any new indicators of compromise linked to this host.