mail[.]skyreals[.]rumahsakit[.]de

Analysis as of July 23, 2026 indicates that the domain mail.skyreals.rumahsakit.de remains active and is being used for a generic phishing campaign. The domain resolves to the IP address 103.52.114.215 and is served through Cloudflare name servers aldo.ns.cloudflare.com and pat.ns.cloudflare.com. VirusTotal scans show that 13 of 95 security vendors have flagged the domain, confirming that multiple detection engines consider it malicious.

The domain is currently listed on one external security blocklist and has been blocked by the PhishDestroy mitigation service, suggesting that at least some community feeds are already propagating the threat indicator. No public information is available regarding the site’s SSL certificate, HTTP response codes, page title, or any observed landing page content, so those vectors remain unverified.

Defenders should add the fully qualified domain name and its resolving IP to firewall deny lists, configure DNS sinks or blocklist feeds to drop traffic to the associated Cloudflare name servers, and monitor for any related C2 patterns that may emerge. Continuous re‑scanning with multi‑vendor platforms is advised to capture any changes in detection status, and any newly observed indicators should be shared with downstream security communities to improve collective response.