vmi2991553[.]contaboserver[.]net

Analysis indicates that vmi2991553.contaboserver.net is a confirmed phishing endpoint operating on infrastructure associated with malicious activity. The domain resolves to IP address 94.72.114.96, hosted on AS40021 (Contabo Inc.) in the United States. Registration occurred on February 21, 2026, through RegistryGate GmbH, with nameservers ns1.contabo.net, ns2.contabo.net, and ns3.contabo.net. At the time of assessment, the domain appears on one security blocklist and is flagged by PhishDestroy.

VirusTotal records show detection by 8 of 95 security vendors, suggesting moderate consensus on its malicious nature. No SSL certificate is present, and the page title matches the domain name, providing no additional brand or service context. The domain is currently offline, though its prior hosting on a known bulletproof provider and detection by multiple security engines warrant continued monitoring.

Defenders should treat this domain as compromised infrastructure and maintain blocklist entries for at least 90 days post-takedown. The absence of a brand target or phishing kit identifier in available data limits attribution to a specific campaign, but the combination of hosting provider, detection count, and blocklist presence supports classification as a generic phishing resource. No Safe Browsing or OTX data was provided for further validation.