posten-bitral[.]com

Analysis of posten-bitral.com as of July 24 2026 indicates the domain is actively associated with a generic phishing campaign. The domain was registered on February 21 2026 through NETIM SAS and uses the netim.net nameserver set (ns1, ns2, ns3). DNS resolution points to 94.26.38.9, an address located in Bulgaria and announced by AS202412 Omegatech LTD. The web server presents an Nginx/OpenResty stack and serves a TLS certificate issued by Let’s Encrypt (certificate identifier E8).

The only observed page title is "Success!". The site has been flagged by PhishDestroy and appears on a single external security blocklist. VirusTotal scans report that two out of ninety‑three antivirus engines label the domain as malicious. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment.

The domain is currently taken offline, which limits immediate probing but does not remove the underlying infrastructure. Defenders should continue to block the IP address 94.26.38.9 and the associated ASN, enforce DNS filtering of the domain, and monitor for any re‑activation. Adding the domain to internal deny‑lists and sharing the indicators with upstream threat‑share platforms is recommended. Because only limited content has been captured, the exact payload or credential‑harvesting page cannot be described; however, the combination of low trust score, detection by multiple vendors, and presence on a phishing‑focused blocklist provides sufficient confidence to treat posten‑bitral.com as a high‑confidence phishing indicator.