bifboxswiss[.]de

Analysis of the domain bifboxswiss.de indicates it was a high-risk phishing infrastructure active as of July 23, 2026. The domain was registered on February 21, 2026, and has since been taken offline, currently returning an HTTP 404 status. Infrastructure analysis reveals it resolved to the IP address 52.213.114.86, hosted on AWS EC2 in the eu-west-1 region (Ireland). At the time of assessment, 12 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appeared on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura.

The page title observed was identical to the domain name, providing no additional context about the intended brand impersonation or specific phishing campaign. No evidence of a targeted brand, phishing kit, or scam category (e.g., crypto, banking, or courier fraud) was present in the available data. The domain's classification as generic phishing is based solely on its detection by multiple security vendors and blocklists, rather than specific indicators of compromise or campaign artifacts.

Defenders should treat this domain as confirmed malicious infrastructure, particularly if logs or network traffic indicate prior connections. Given its current offline status, further analysis of the site's content is not possible, and no additional indicators (e.g., SSL certificates, subdomains, or redirect chains) were provided in the available intelligence. Organizations are advised to block the domain and its associated IP address in perimeter defenses and monitor for any re-emergence or related infrastructure.