barmenia-gothaer-am[.]com

Analysis of the domain barmenia-gothaer-am.com indicates it is an active phishing infrastructure targeting insurance customers, registered on July 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. The domain resolves to IP address 188.114.97.3, hosted on Cloudflare nameservers owen.ns.cloudflare.com and ullis.ns.cloudflare.com, a common pattern observed in phishing campaigns leveraging Cloudflare’s proxy services to obscure hosting origins. As of August 1, 2026, the domain remains active and has been flagged on one security blocklist, though it has not yet been detected by any of the 91 vendors in the most recent VirusTotal scan. The absence of detections in VirusTotal does not confirm safety, as phishing domains often evade initial scans during early deployment phases.

Infrastructure analysis reveals the domain was created three days prior to the report date, aligning with typical phishing domain lifecycles where rapid deployment precedes abuse. The registrar, Trustname.com, has been associated with other high-risk domains, though no direct evidence links it to this specific campaign. The domain’s name, combining 'barmenia' and 'gothaer'—both known insurance providers—suggests an intent to impersonate legitimate insurance services, though the exact content and targeting methods remain unverified. No page title, brand kit, or scam subtype (e.g., credential harvesting, policy fraud) has been confirmed in available data.

Defenders should treat this domain as high-risk pending further investigation. The IP address 188.114.97.3 should be monitored for additional malicious domains, and network-level blocking is recommended based on the existing blocklist entry. Organizations should also review logs for connections to this domain, particularly from internal users accessing insurance-related services. Given the domain’s recent registration and active status, additional indicators of compromise may emerge as the campaign progresses.