ly[.]cmcndt6[.]sa[.]com

The domain ly.cmcndt6.sa.com was observed serving a page whose title reads 'Portal für Privatkunden - Volksbank Raiffeisenbank', indicating an attempt to impersonate the German Volksbank Raiffeisenbank online banking portal. The site was hosted on IP address 217.154.225.163, which belongs to ASN 8560 operated by IONOS SE in Germany. Registration details show the domain was provisioned through the de-ber-ionos-cloud-ber registrar, confirming the hosting relationship. No TLS certificate was presented, meaning the service was delivered over plain HTTP, a common characteristic of credential‑harvesting sites.

VirusTotal scans returned 13 positive detections out of 95 engines, providing independent confirmation of malicious behavior. Google Safe Browsing flagged the domain for social engineering, and the domain appears on at least one public blocklist, with PhishDestroy actively blocking it. The Gridinsoft trust score of zero out of one hundred further reflects a high confidence of malicious intent. As of the report date the domain is listed as offline, suggesting that the infrastructure has been taken down or is no longer reachable, but the recorded indicators remain valuable for historical and predictive threat‑intel purposes.

Defensive operators should add the domain and its resolved IP address to firewall deny lists, DNS sinkhole configurations, and endpoint blocklists. Continuous monitoring of the registrar and ASN for newly created subdomains that resolve to the same IP range is recommended, as threat actors frequently recycle the same hosting environment. Updating intrusion‑detection signatures to match the observed page title and the lack of SSL can improve early detection of re‑hosted copies. The combination of multiple vendor detections, safe‑browsing classification, and a zero trust score provides a strong basis for treating any future activity from this infrastructure as high‑risk.