biilliger-fliegen[.]de

This report analyzes the domain biilliger-fliegen.de. The site's page title is "Redirecting...", indicating no legitimate branded content is displayed. Based on the domain name, which resembles a misspelling of "billiger-fliegen" (German for "cheaper flying"), the site likely impersonates a travel or flight booking service. The primary threat is that the site redirects users to unknown malicious destinations, potentially for phishing or malware distribution.

Technical analysis reveals a high-risk profile. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, including BitDefender and Chong Lua Dao. The domain is registered with REGISTRAR_NOT_FOUND, indicating obscure registration. It resolves to IP address 172.237.154.253, hosted in the US by AS63949 Akamai Connected Cloud. The SSL certificate is issued by Let's Encrypt with fingerprint E7, which is commonly used for legitimate sites but here adds false trust. Nameservers are ns1.parklogic.com, ns2.parklogic.com, and ns3.parklogic.com. Cloaking is detected via content divergence, where the page shown to users differs from what scanners see.

The domain status is ACTIVE. GridinSoft trust rating is 0 out of 100, and the DOM risk score is 100, the highest possible. This domain poses an immediate and severe threat, with evidence of malicious intent through high vendor detection, cloaking, and a redirecting page. It should be blocked and avoided.