klosterhof-cronschwitz[.]de

The domain klosterhof-cronschwitz.de is currently active and has been identified as a high‑risk brand‑impersonation campaign targeting Facebook. The site appears on two public blocklists, PhishDestroy and PhishingDB, and is referenced in sixteen AlienVault OTX threat‑intel pulses. VirusTotal analysis shows that sixteen of ninety‑five security vendors have flagged the domain, indicating a consensus of malicious intent.

Infrastructure analysis shows the domain resolves to the IPv4 address 217.160.0.107, which belongs to the German AS8560 network operated by IONOS SE. The hosting environment publishes four authoritative nameservers—ns1019.ui-dns.biz, ns1042.ui-dns.de, ns1110.ui-dns.com, and ns1125.ui-dns.org—suggesting use of a standard DNS provider. HTTP requests receive a 301 redirect, the server reports both Nginx and Apache HTTP Server components, and HTTP Strict Transport Security (HSTS) is enabled. The TLS certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, and the Gridinsoft trust score is 0 out of 100. Google Safe Browsing classifies the URL as “SOCIAL_ENGINEERING”. The page title returned is “Standardsouth – Just another WordPress site”, which bears no obvious relationship to the Facebook brand.

Given the combination of blocklist listings, multiple vendor detections, and a low trust score, the domain is highly likely to be used for social‑media credential harvesting or other fraudulent interactions under the guise of Facebook. Defenders should proactively block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP range, and ensure that any user‑reported URLs matching the page title or SSL fingerprint are investigated. Continuous threat‑intel feeds should be consulted for any emerging indicators, and remediation actions should be documented to maintain compliance with high‑risk phishing response procedures.