yahonda[.]rumahsakit[.]de

Analysis of the domain yahonda.rumahsakit.de shows it is currently active and associated with a high‑risk credential‑harvesting campaign. The domain resolves to the IPv4 address 103.52.114.215 and is serviced by Cloudflare nameservers aldo.ns.cloudflare.com and pat.ns.cloudflare.com. Reputation data indicates the domain appears on two security blocklists and is explicitly listed by PhishDestroy and OpenPhish, confirming that it has been observed delivering phishing content.

VirusTotal scans have returned detections from 18 of 95 security vendors, reinforcing the malicious classification. No additional public indicators such as SSL certificate details, HTTP response codes, or page titles have been disclosed, leaving the surface‑web characteristics of the site unverified. The available evidence points to a phishing infrastructure that leverages Cloudflare’s DNS service to obscure the true hosting environment, a tactic commonly seen in active campaigns.

Defenders should block network traffic to the IP address 103.52.114.215 and add the domain to local and cloud‑based URL filtering policies. Continuous monitoring of the domain’s DNS records is advised, as changes to the nameserver configuration could signal new campaign stages. Analysts should also flag any outbound connections from internal hosts to this domain for deeper inspection, and consider sharing the indicator set with threat‑sharing platforms to improve collective detection.