sslvhconnectclients[.]wan64[.]de

This domain, sslvhconnectclients.wan64.de, is actively engaged in brand impersonation targeting 1&1 Ionos, as indicated by its page title 'Login - IONOS' and confirmed intelligence. Registered on December 18, 2025, the domain remains operational as of July 12, 2026, resolving to the IP address 144.172.100.203. Infrastructure analysis reveals the domain is hosted under an SSL certificate issued by SSL Corp, a detail that may aid in tracking related campaigns. Detection metrics show the domain is flagged by 16 of 95 security vendors on VirusTotal, while GridinSoft assigns it a trust score of 0/100, further corroborating its malicious classification. The domain appears on one security blocklist, specifically PhishDestroy, though broader adoption across blocklists remains limited. Defenders should note that while the domain’s creation date aligns with typical phishing campaign timelines, its relatively low blocklist prevalence suggests it may still be in the early stages of distribution or evading broader detection. The absence of additional infrastructure details, such as ASN or registrar information, limits attribution efforts, though the SSL certificate provider may serve as a pivot point for further investigation. Given the high-risk classification, immediate blocking of the domain and associated IP (144.172.100.203) is recommended for organizations utilizing 1&1 Ionos services or those prioritizing brand protection. Monitoring for related domains under the wan64.de parent domain may also reveal additional threats. No evidence currently links this domain to a specific phishing kit or broader campaign infrastructure, though the impersonation of a web hosting provider’s login portal suggests credential harvesting as the likely objective.