mail[.]itsmebay[.]rumahsakit[.]de

The domain mail.itsmebay.rumahsakit.de is currently active and associated with a generic phishing campaign as indicated by the threat classification. Infrastructure analysis shows the domain resolves to the IPv4 address 103.52.114.215 and is served through Cloudflare DNS with authoritative name servers aldo.ns.cloudflare.com and pat.ns.cloudflare.com. The TLS certificate presented is issued by Let’s Encrypt, identified as the YR2 profile, confirming the use of a free, automated certificate authority. VirusTotal reports that 15 out of 91 scanning vendors have flagged the domain, suggesting a non‑trivial detection rate among security products. No additional intelligence such as page content, malware payloads, or associated command‑and‑control infrastructure is available at this time. Defenders should consider adding the domain and its resolved IP to blocklists, enforce outbound filtering for HTTP/S traffic to the host, and monitor DNS queries for the associated Cloudflare name servers. Continuous re‑evaluation is advised, as the infrastructure may be re‑hosted or leveraged in future phishing campaigns.