admhr[.]execsuccessmetrics[.]de

Analysis of the domain admhr.execsuccessmetrics.de indicates active credential-phishing infrastructure targeting enterprise users. The domain was registered on June 14, 2026, through a registrar that has not been publicly identified in available intelligence. Infrastructure analysis reveals the domain resolves to the IP address 172.67.202.99, which is associated with Cloudflare's network, a common obfuscation tactic used to conceal hosting origins and evade IP-based blocking. As of July 29, 2026, the domain appears on a single security blocklist, specifically PhishDestroy, suggesting early detection by at least one vendor specializing in phishing mitigation.

VirusTotal telemetry reports that 14 out of 91 security vendors flag admhr.execsuccessmetrics.de as malicious, a detection rate consistent with emerging phishing campaigns that have not yet achieved broad coverage across all engines. The absence of additional blocklist entries or Safe Browsing warnings does not indicate benign status; rather, it reflects the domain's recent activation and the lag time inherent in multi-vendor detection pipelines. No HTTP status codes, SSL certificate anomalies, or page titles are available in the current dataset, limiting further assessment of the site's exact content or brand impersonation tactics. Defenders are advised to treat this domain as elevated risk based on the combination of recent registration, Cloudflare proxying, and confirmed phishing classification by multiple security vendors.

Network-level blocking of 172.67.202.99 and the domain itself is recommended for organizations with enterprise authentication portals. Monitoring for related subdomains or newly registered domains under execsuccessmetrics.de may reveal additional infrastructure tied to the same campaign. Given the domain's age and detection profile, further analysis of its hosting provider and registrar details could yield additional indicators for threat hunting.