fft[.]flixbus-flixtrain-straftaten[.]cf

The domain fft.flixbus-flixtrain-straftaten.cf was observed hosting a directory index page titled "Index of /" and is currently taken offline. Infrastructure analysis shows the domain resolves to 172.93.120.134, an address allocated to Host4Geeks LLC in the United States under ASN AS393960. Both authoritative name servers, ns1.skerba.life and ns2.skerba.life, resolve to the same IP block, indicating a single‑provider hosting model. No SSL certificate is presented, meaning all HTTP traffic would be unencrypted, a common trait of low‑effort phishing infrastructure.

Reputation services uniformly rate the domain as highly untrustworthy: Gridinsoft assigns a trust score of 0 out of 100, Scamadviser reports 1 out of 100, and the site appears on one known security blocklist. Google Safe Browsing flags the domain for social engineering, and PhishDestroy has actively blocked it. VirusTotal scans returned detections from 16 of 95 security vendors, reinforcing the malicious assessment.

The limited public intelligence does not reveal a specific phishing kit or content beyond the directory index, and no additional branding or landing pages have been captured. Defenders should add the domain and its associated IP address to network and endpoint blocklists, monitor for any future resolution changes, and consider extending controls to the sibling name servers. Continuous observation of the hosting provider’s IP space is advised, as the same infrastructure may be reused for other malicious campaigns.