mailadmin[.]hochblutdruck[.]de

This domain, mailadmin.hochblutdruck.de, is flagged as an active credential phishing threat. Analysis indicates it remains operational as of July 12, 2026, with a 'Redirecting...' page title, suggesting an intermediary or cloaking mechanism to obscure its final destination. The domain is listed on one security blocklist and is detected by 12 of 91 security vendors in a recent scan, reinforcing its classification as high-risk. Infrastructure analysis reveals it resolves to 172.234.213.23, hosted on AS63949 (Akamai Connected Cloud) in the US, with nameservers under ParkLogic (ns1.parklogic.com, ns2.parklogic.com, ns3.parklogic.com), a provider frequently associated with malicious or abused domains. MX records point to mx156.hostedmxserver.com (priority 940), which may be leveraged for email-based phishing campaigns. The domain employs Nginx and OpenResty web technologies, common in both legitimate and malicious setups, and uses a Let's Encrypt SSL certificate (YE1), which provides encryption but does not validate legitimacy. While the exact target or brand impersonation is not confirmed in available data, the scam type is explicitly credential phishing, indicating a focus on harvesting login credentials. Defenders should treat this domain as hostile and prioritize blocking it at the DNS, proxy, or firewall level. Additional monitoring of associated MX and nameserver infrastructure may reveal related threats. The domain's continued activity and detection by multiple vendors warrant immediate action to prevent potential credential theft or lateral movement within networks.