weltkompass[.]click

The domain weltkompass.click was registered on June 26, 2026 through NameSilo, LLC and remains active as of the report date, August 07, 2026. DNS resolution points to the IP address 104.21.89.2, which is served by Cloudflare nameservers gerardo.ns.cloudflare.com and kristina.ns.cloudflare.com. The domain appears on a single security blocklist and is explicitly listed as blocked by the PhishDestroy feed, indicating that at least one trusted threat‑intelligence source has identified it as a malicious resource.

VirusTotal records show that the domain was submitted for analysis and scanned by 91 antivirus and URL‑reputation vendors; none of the engines generated a detection at the time of the scan. While the absence of detections does not constitute a safety guarantee, it does suggest that the payload or landing page may be employing techniques that evade current signatures or that the analysis was limited to static indicators. No public SSL certificate details, HTTP response codes, page titles, or content snapshots have been released, leaving the exact phishing lure and target brand unconfirmed.

The combination of recent registration, Cloudflare hosting, inclusion on a phishing‑specific blocklist, and the lack of publicly disclosed content points to a typical “drop‑and‑wait” phishing infrastructure that may be activated on demand. Defenders should proactively block the domain at the DNS level, incorporate it into URL filtering policies, and monitor outbound connections to the associated IP address for anomalous traffic patterns. Continuous re‑evaluation is advised, as the threat actor may later publish a phishing page that could trigger detections in future vendor scans or community feeds.