restposten-plattform[.]de

This domain, restposten-plattform.de, is flagged as a generic phishing site targeting users through fraudulent job portal impersonation. Analysis of the page title, WerkXheld Linkliste, suggests an attempt to mimic legitimate employment or classifieds platforms, likely designed to harvest credentials or distribute malicious payloads. The domain exhibits no direct association with known brand names or drainer kits, but its infrastructure and content structure align with credential theft campaigns observed in recent months. Infrastructure analysis reveals critical technical indicators: the domain resolves to IP 217.160.0.200, hosted on AS8560 (IONOS SE) in Germany, and is flagged by 12 out of 95 security vendors on VirusTotal. It appears on two security blocklists, including PhishDestroy and PhishingDB, and uses a Sectigo Limited SSL certificate (Sectigo Public Server Authentication CA DV R36) to create a false sense of legitimacy. The registrar remains undisclosed, but historical WHOIS data suggests recent registration, a common trait in phishing operations. Google Safe Browsing status is not explicitly listed, but the domain's presence on multiple blocklists confirms its malicious classification. As of the latest assessment, restposten-plattform.de has been taken offline, reducing immediate exposure risk. However, the infrastructure—particularly the IP and hosting provider—may still pose residual threats. Users who interacted with the domain should immediately revoke any submitted credentials, monitor accounts for unauthorized access, and scan devices for malware. Organizations are advised to update blocklists with the domain and IP, while security teams should investigate related indicators, such as the SSL certificate issuer and AS8560 hosting patterns, for broader campaign linkages.