deutsbhome[.]org

Analysis of the domain deutsbhome.org indicates that it was registered on 21 February 2026 and subsequently taken offline. The site presented a page titled “Deutsche Bank – Accounts Management”, yet the intelligence tags it as a social‑media phishing operation that impersonates Facebook. The mismatch between the page title and the advertised brand suggests a credential‑harvesting campaign that leverages the reputation of a financial institution to lure victims into a Facebook‑focused credential dump. The domain resolves to the IPv4 address 51.38.123.251, which belongs to the OVH SAS network (AS16276) located in Germany. The hosting provider is therefore a known commercial cloud service, and the IP is listed on a single security blocklist.

SSL analysis shows the site used a certificate identified as “R13”, but no further details on issuer or validity period are provided. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low confidence in legitimacy. VirusTotal scans returned 14 positive detections out of 93 participating vendors, confirming that multiple security engines flag the domain as malicious. The threat has also been referenced in one AlienVault OTX pulse and is actively blocked by the PhishDestroy service.

No additional public detections, such as Safe Browsing entries, are documented. Given the combination of a low trust score, multiple vendor detections, and confirmation from blocklists and threat‑intel feeds, security teams should continue to block the domain at network perimeters, monitor for any residual traffic to the associated IP address, and consider adding the indicator to internal phishing detection rules. Analysts should also verify whether any compromised credentials have been observed in logs, as the campaign’s focus on Facebook accounts may indicate broader credential‑reuse attacks.