647623577[.]dojiner[.]at

On July 20 2026 the domain 647623577.dojiner.at was observed hosting a generic phishing campaign. The domain resolves to the IPv4 address 192.162.199.140 and is served over TLS using a Let’s Encrypt certificate issued in the current year (YR1). Google Safe Browsing classifies the site as a social‑engineering threat, and the domain appears on one external blocklist. VirusTotal analysis shows that fifteen of ninety‑five scanned security vendors have issued detections against the domain, confirming malicious activity. The authoritative name servers are arely.ns.cloudflare.com and lou.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The domain is actively blocked by the PhishDestroy service, reinforcing its reputation as a phishing resource. Current monitoring confirms that the domain remains active as of the report date. The use of Cloudflare DNS suggests a level of resilience against takedown attempts, while the Let’s Encrypt certificate provides encryption without revealing any organization‑specific identifiers. No registrar information is supplied, and the lack of publicly available page title or brand targeting means that content analysis remains pending. Nevertheless, the aggregation of detection signals—Google Safe Browsing, VirusTotal vendor votes, inclusion on a security blocklist, and active blocking by PhishDestroy—constitutes a high confidence indicator of malicious intent. Defenders should add 192.162.199.140 to network deny lists, enforce DNS filtering for 647623577.dojiner.at, and ensure that endpoint protection solutions incorporate the fifteen VirusTotal detections. Organizations should update their threat intelligence feeds with the domain and associated IP, apply URL filtering rules, and monitor for any outbound connections to the host. Given the active status, ongoing observation is recommended to capture any evolution of the phishing infrastructure.