land18[.]aabenrapharma[.]de

Analysis of land18.aabenrapharma.de as of July 27 2026 indicates that the domain is actively being used for a generic phishing campaign. The domain is hosted on Cloudflare infrastructure, as evidenced by its authoritative nameservers bingo.ns.cloudflare.com and watson.ns.cloudflare.com, and resolves to the IP address 188.114.97.3. VirusTotal scans show that five of ninety‑one security vendors flagged the domain, a signal that at least a subset of scanners have identified malicious behavior. The domain appears on one public security blocklist and is listed by the PhishDestroy sinkhole service, reinforcing the classification as a phishing resource.

The threat rating assigned is high, and the status remains active. Publicly available intelligence does not include details on the registrar, SSL certificate, HTTP response codes, or page title, and no additional reputation services such as Safe Browsing or Open Threat Exchange have published observations for this host. Consequently, the confidence in the phishing attribution rests primarily on the blocklist entry, the PhishDestroy detection, and the VirusTotal vendor flags.

Defenders should block or quarantine any traffic to land18.aabenrapharma.de at the network perimeter, include the associated IP 188.114.97.3 in deny lists, and monitor DNS queries for the domain. Email security gateways should treat messages containing this domain as malicious, and endpoint protection solutions should enforce the blocklist entry. Continuous re‑evaluation is advised in case additional indicators, such as SSL certificate details or page content, become available.