salzburgweltreisen[.]de

This domain, salzburgweltreisen.de, was observed hosting a generic phishing site that has been taken offline as of the report date. DNS resolution points to the IPv4 address 202.61.197.60, which is allocated to netcup GmbH under ASN 197540 and geolocated to Germany. The authoritative nameservers are root-dns.netcup.net, second-dns.netcup.net, and third-dns.netcup.net, confirming the netcup hosting environment. No TLS certificate is presented, indicating the site was served over plain HTTP.

The page title returned by the HTTP response is “Payload Website Template”, suggesting the use of a reusable phishing template rather than a targeted brand page. VirusTotal records show that four of ninety‑three scanning engines flagged the domain, demonstrating partial detection across the security community. The domain is listed on two independent phishing blocklists, PhishDestroy and ScamSniffer, and receives a Gridinsoft trust score of 0 out of 100, reinforcing its malicious classification. The site’s current status is offline, preventing further live analysis.

However, the lack of SSL, the generic page title, and the low trust score provide strong indicators of malicious intent. Uncertainty remains regarding the exact phishing campaign payload, target victims, and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the same IP address. Defenders should immediately block DNS resolution to 202.61.197.60 and add salzburgweltreisen.de to web‑filter deny lists. Continuous monitoring of the netcup IP range for new domains and periodic re‑scanning of the host are advised to detect potential re‑use of the infrastructure.