swisspost[.]zahlung2461[.]cfd

The domain swisspost.zahlung2461.cfd was registered on 21 February 2026 and is currently marked offline. Infrastructure analysis shows the domain resolves to the IP address 172.67.160.95, which belongs to AS13335 operated by Cloudflare, Inc. in the United States. The SSL certificate presented for the host is identified as WE1, indicating a self‑signed or otherwise low‑reputation certificate. Reputation services have assigned extremely low trust scores: Scamadviser rates the site 1 / 100 and Gridinsoft 0 / 100.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal reports that 13 of 93 scanned security vendors flagged the domain, reinforcing the malicious classification. The threat type is catalogued as a generic phishing campaign with an elevated risk rating.

At present, no additional intelligence such as page title, brand targeting, or observed payloads has been published, leaving the exact phishing lures and victim profile uncertain. Defenders should continue to deny any network connections to 172.67.160.95, update URL filtering rules to include swisspost.zahlung2461.cfd, and monitor related Cloudflare‑hosted IP ranges for similar activity. Because the domain is already offline, remediation focus should shift to preventing reuse of the same infrastructure and to educating users about unsolicited communications that reference Swiss Post or related financial services.