onyxeternisafe[.]de

On July 25, 2026, the domain onyxeternisafe.de was observed to be taken offline. The site resolved to the Cloudflare‑owned address 104.21.17.157, located in the United States under ASN 13335. DNS resolution used the Cloudflare name servers selah.ns.cloudflare.com and venkat.ns.cloudflare.com, indicating the infrastructure is fully hosted behind Cloudflare’s edge network and was serving traffic over HTTP/3. The SSL certificate presented by the host was issued by Google Trust Services under the WE1 designation, a standard certificate for Cloudflare‑proxied sites.

Passive scanning on VirusTotal recorded nine positive detections out of ninety‑three submitted security vendors, and the domain appears on a single external blocklist. The threat intelligence platform AlienVault OTX referenced the domain in one pulse, and the commercial anti‑phishing service PhishDestroy listed it as blocked. Gridinsoft’s trust scoring system assigned a rating of zero out of one hundred, reflecting a high confidence in malicious intent. The only visible page element captured was the title “Support”, with no additional content analysis available.

While the limited artifact set confirms the domain’s association with generic phishing activity, the precise payload, target brand, or credential‑harvesting technique cannot be verified from the current data set. Defenders should therefore treat onyxeternisafe.de as a high‑confidence malicious indicator. Immediate actions include adding the domain and its resolved IP address to network deny lists, updating URL filtering policies, and monitoring for any re‑registration or DNS changes that could resurrect the site. Continuous querying of threat‑intel feeds for new OTX pulses or blocklist entries is recommended to maintain situational awareness.