autodiscover[.]designtingleflowx[.]shop

Analysis dated 23 July 2026 indicates that the domain autodiscover.designtingleflowx.shop is currently offline but retains multiple indicators consistent with a credential‑phishing operation. The site previously presented a web page whose HTML title was reported as "mail.codora.shop – mail UI", suggesting an attempt to impersonate a mail service of the codora.shop brand. The TLS certificate was issued by Let’s Encrypt and bears the E7 identifier, confirming that the domain had an active HTTPS endpoint at the time of observation. DNS resolution points to the address 65.21.205.126, an IP block owned by Hetzner Online GmbH in Finland (ASN 24940). Registration metadata ties the domain to the DE‑HETZNER‑20010926 registrar, reinforcing the Hetzner hosting relationship. Reputation services have flagged the domain.

Google Safe Browsing classifies the URL as social engineering, and the domain appears on one public security blocklist. PhishDestroy has listed the domain as blocked, and VirusTotal recorded twelve positive detections out of ninety‑five scanners, indicating a moderate consensus among anti‑malware engines that the domain is malicious. The listed scam type is credential phishing, which aligns with the observed mail‑service mimicry. Uncertainty remains regarding the exact contents of the landing page, the credential collection mechanism, and the duration of active hosting, as the site is currently taken offline. No additional intelligence such as observed payloads, malware families, or victim reports has been published.

Defenders should treat autodiscover.designtingleflowx.shop as a high‑risk indicator. Network perimeter devices should block DNS resolution and HTTP(S) requests to the domain and its associated IP address. Email security gateways ought to add the domain to blocklists and enforce URL filtering for any links referencing the domain.