id[.]handel[.]mobile[.]de-login-service[.]primemassagemaltonivel[.]com[.]br

The domain id.handel.mobile.de-login-service.primemassagemaltonivel.com.br is flagged for an elevated-risk brand impersonation threat targeting mobile.de. The domain impersonates the legitimate mobile.de Händler-Login page, potentially to deceive users into divulging their credentials.

Analysis indicates that the domain was created on February 09, 2024, and is registered through HGBLOCK-4 (ASN: 19871). The domain resolves to the IP address 108.167.171.15, which is located in the United States (AS19871 Network Solutions, LLC). The domain has been flagged by 17 out of 95 security vendors on VirusTotal, and it appears on 2 security blocklists, including PhishDestroy and PhishingDB. The Google Safe Browsing (GSB) status is not explicitly provided, but the high number of flags suggests it is likely marked as unsafe.

The domain is currently offline, which indicates that it has been taken down as part of a response action. However, the potential for residual risk remains, as the domain could be reactivated or the same threat actors could use similar tactics with new domains. Security teams are advised to monitor for reactivation and to educate users about the importance of verifying URLs and using multi-factor authentication to protect against credential theft.