cembra[.]swiss-pageweb[.]com

The domain cembra.swiss-pageweb.com is identified as a generic phishing infrastructure actively posing as Cembra, a financial services brand. Current threat intelligence confirms the domain remains operational and is being used for credential harvesting or fraudulent transactions targeting unsuspecting users. The active status indicates ongoing malicious activities.

Analysis indicates this domain is flagged by 6 of 95 VirusTotal vendors, suggesting limited but notable detection across security platforms. Infrastructure analysis reveals registration through Spaceship, Inc., resolution to IP address 185.80.130.247, and a creation date of June 16, 2026. The domain’s recent establishment and low detection rate may indicate a rapidly evolving or opportunistic campaign. Given the absence of trust indicators, this infrastructure poses a significant risk for users engaging with it.

Current status of the domain remains active, with sustained malicious operations observed. Network defenders should immediately block inbound and outbound traffic to 185.80.130.247 and cembra.swiss-pageweb.com at network perimeter and DNS layers. Endpoint detection rules should be updated to flag any observed connections or downloads from this infrastructure. Additionally, users should be warned to avoid interaction with this domain and any associated subdomains. Security teams should monitor for related domains registered through Spaceship, Inc. after June 16, 2026, and correlate with observed IP ranges to prevent lateral movement or further exploitation.