volkerstruth[.]com

Analysis as of July 29 2026 indicates that the domain volkerstruth.com was registered on 27 April 2025 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 172.67.130.221, which is hosted behind Cloudflare’s DNS infrastructure (cesar.ns.cloudflare.com, teresa.ns.cloudflare.com). The domain appears on a single public blocklist and is explicitly listed by the PhishDestroy feed, which classifies it as a generic phishing site. VirusTotal scans have yielded three positive detections out of ninety‑one AV engines, confirming that at least a subset of security products consider the domain malicious. No additional public intelligence such as Google Safe Browsing, OTX, or SSL certificate metadata has been disclosed, and the HTTP response code or page title has not been published.

Consequently, the observable surface consists of registration data, hosting resolution, blocklist presence, and limited vendor detections. The available evidence suggests that the infrastructure is leveraging Cloudflare’s edge network to mask the true origin of the host, a common tactic for credential‑harvesting operations. The low blocklist count (one) and modest VirusTotal detection ratio (3/91) may indicate that the campaign is either newly deployed or deliberately low‑profile, but the presence on PhishDestroy confirms active malicious use. Defenders should add volkerstruth.com to internal block and DNS sinkhole lists, monitor outbound DNS queries for the domain and its associated Cloudflare nameservers, and enforce URL filtering based on the observed IP address 172.67.130.221.

Continuous re‑scanning on VirusTotal or similar multi‑engine platforms is recommended to capture any escalation in detection counts. Organizations should also consider reviewing authentication logs for attempted credential submissions that could be directed to this domain, especially for accounts that may target generic phishing lures.