phosphor[.]eu

On 25 July 2026 the domain phosphor.eu was observed to host a web resource that returns HTTP 301 redirects and presents the page title “phosphor.eu steht zum Verkauf – Sedo.com”. The site is served from the Cloudflare edge address 104.16.140.114, which belongs to AS13335 Cloudflare, Inc. and resolves to a United States location. TLS is provided by a Sectigo Limited public server authentication certificate issued by the Sectigo Public Server Authentication CA DV R36, confirming the use of a valid, albeit generic, SSL chain. Header analysis shows HSTS enforcement and the presence of Apple iCloud Mail references, indicating that the infrastructure may be leveraging Apple’s mail services for outbound communications. The domain is delegated to the nameservers eu-sedo-ns1.yoursrs.com and eu-sedo-ns2.yoursrs.com, consistent with Sedo’s marketplace platform.

Registrar information lists Realtime Register B.V. as the sponsoring registrar. The domain appears on the PhishDestroy blocklist, and the Gridinsoft trust score assigns a value of 0 out of 100, reflecting a severe lack of trust. VirusTotal scans report that 6 of 93 security engines flagged the domain, reinforcing the suspicion of malicious intent. No additional public intelligence such as OT X feeds or safe‑browsing entries are cited.

Given the combination of a marketplace‑style page title, active blocklisting, low trust rating, and multiple vendor detections, the evidence supports a high‑risk phishing classification. The exact phishing payload or targeted brand has not been disclosed; analysts should therefore treat any communications originating from or referencing phosphor.eu as potentially fraudulent. Defenders are advised to block the domain at perimeter firewalls, update URL filtering lists with the PhishDestroy indicator, and monitor for related iCloud Mail activity.