arnbsix[.]rumahsakit[.]de

arnbsix.rumahsakit.de is currently listed as an active generic phishing infrastructure. The domain resolves to the IPv4 address 103.52.114.215 and is serviced by Cloudflare name servers aldo.ns.cloudflare.com and pat.ns.cloudflare.com, indicating the use of Cloudflare's DNS and likely DDoS mitigation services. Reputation checks show that the domain is present on two public phishing blocklists and has been explicitly blocked by the PhishDestroy and OpenPhish feeds. VirusTotal records indicate that 19 of 95 scanned security vendors have flagged the domain as malicious, reinforcing the classification as a phishing resource.

The threat is rated high in the supplied intelligence, and the seed identifier 1a6414 is associated with this observation. Analysis confirms that the domain remains active as of the report date (July 22, 2026). No additional attributes such as SSL certificate details, HTTP response codes, or page title have been disclosed, leaving the content of the hosted site unverified. Consequently, defenders cannot assess the specific lure or credential‑capture mechanisms employed beyond the generic phishing label.

Given the observed indicators, security teams should prioritize blocking network traffic to 103.52.114.215 and add arnbsix.rumahsakit.de to local deny lists. Monitoring of DNS queries to the associated Cloudflare name servers may provide early warning of further malicious activity. Continuous re‑scanning on VirusTotal or similar multi‑engine platforms is recommended to capture any changes in detection rates. Organizations that employ email filtering should ensure that messages containing this domain are quarantined, and incident response procedures should be prepared to investigate any credential submissions that may originate from this infrastructure.