deutsche-bank[.]live[.]itonicsit[.]de

This domain, deutsche-bank.live.itonicsit.de, is currently flagged as an active phishing infrastructure impersonating a financial institution login portal. Analysis indicates the subdomain resolves to 3.68.163.74, hosted on infrastructure associated with ASN 16509, and presents a page titled 'Deutsche Bank | Login.' The domain holds a trust score of 0 out of 100 and is detected by 4 out of 95 security vendors as malicious, with active listings on three security blocklists, including PhishDestroy and PhishingDB. Infrastructure analysis reveals the use of Drupal, PHP, Apache HTTP Server, and jQuery-based libraries, suggesting a structured phishing kit rather than a hastily deployed page. The SSL certificate is issued by Amazon, which aligns with the hosting provider but does not mitigate the malicious intent. While the exact content of the page remains unanalyzed, the combination of the page title, detected technologies, and blocklist status confirms the domain is designed to harvest credentials under the guise of a legitimate banking login. Defenders should treat this domain as high-risk due to its active status, confirmed impersonation of a financial brand, and detection by multiple security mechanisms. The subdomain structure, incorporating a recognizable brand name, increases the likelihood of successful social engineering. Network-level blocking of 3.68.163.74 and monitoring for related subdomains under itonicsit.de are recommended. Further investigation into the registration details and hosting provider may reveal additional linked infrastructure, though no attribution beyond the ASN is currently available.