bundesprofit-ki[.]de

The domain bundesprofit-ki.de was observed to host an investment‑scam phishing campaign before being taken offline. DNS resolution points to the Cloudflare edge address 172.67.208.29, hosted in Canada under the Cloudflare, Inc. network. The authoritative nameservers are cameron.ns.cloudflare.com and linda.ns.cloudflare.com, both standard Cloudflare resolvers. TLS termination is provided by a Google Trust Services certificate issued by the WE1 intermediate, indicating the use of a legitimate certificate chain to increase credibility.

HTTP headers reveal the presence of HTTP/3 and HSTS, confirming modern transport security. Google Safe Browsing categorises the site as social engineering, and fourteen of ninety‑one VirusTotal scanners have flagged the domain as malicious, reinforcing the suspicion of phishing activity. Independent blocklists have listed the domain on three separate feeds, and commercial anti‑phishing services PhishDestroy, MetaMask, and SEAL have recorded it as blocked. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation.

No public page title or content snapshot is available, so the exact lure text and landing‑page structure remain unknown. Analysts should continue to enforce network‑level deny rules for the IP address 172.67.208.29 and the domain name, update intrusion‑detection signatures to include the observed TLS fingerprint, and monitor for re‑registration or similar domains using the same naming pattern. Threat intel sharing with partner organizations is recommended, as the combination of Cloudflare hosting, a valid Google certificate, and low trust scores is a common pattern for fast‑flux investment scams.