confluence[.]aposteln-ffm[.]de

Analysis indicates that confluence.aposteln-ffm.de was registered on 21 February 2026 and is hosted on IP 84.200.193.47, which belongs to AS214036 Ultahost, Inc. in Germany. The domain resolves to the same IP, uses GoDaddy’s default nameservers ns05.domaincontrol.com and ns06.domaincontrol.com, and does not present an SSL certificate, causing all HTTPS attempts to fail. An HTTP request returns a 404 status code, and the only visible page element is the title “confluence.aposteln-ffm.de”.

Gridinsoft assigned a trust score of 0 out of 100, and the site appears on one external blocklist, specifically PhishDestroy, which has also taken the domain offline. VirusTotal analysis shows that 12 of 93 scanning engines flagged the domain, demonstrating a modest but non‑trivial detection rate. The lack of SSL, combined with a low trust score and multiple vendor detections, aligns with typical characteristics of a generic phishing infrastructure.

However, the current offline status and 404 response limit immediate observation of malicious payloads, so the exact phishing content cannot be verified at this time. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑hosting or resurrection attempts, and add the IP address 84.200.193.47 to reputation lists. Incident response teams should also review any recent logs for connections to this host, especially from internal users who may have accessed the URL before it was taken down, and consider enforcing TLS‑only policies to prevent future exposure to similar unsecured domains.