concorde[.]maut1[.]de

Analysis of concorde.maut1.de on July 23, 2026, identifies an active phishing domain hosted behind Cloudflare infrastructure. The domain was registered on February 22, 2026, and currently returns an HTTP 200 status with a page titled 'Attention Required! | Cloudflare.' This title typically indicates a Cloudflare challenge or interstitial page, though the exact content served after any challenge remains unconfirmed. The domain resolves to 172.67.72.207 (AS13335, Cloudflare, Inc., US) and uses Cloudflare nameservers (ezra.ns.cloudflare.com, sunny.ns.cloudflare.com).

Detected technologies include Bootstrap, HSTS, Google Tag Manager, Cloudflare Browser Insights, and HTTP/3, suggesting a modern web stack likely used to evade basic detection. The domain appears on one security blocklist (PhishDestroy) and is flagged by a single vendor on VirusTotal, indicating limited but confirmed malicious classification. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious sites. No specific brand, scam type, or phishing kit has been identified in the available data, and the page content beyond the Cloudflare interstitial is not yet analyzed.

Defenders should treat concorde.maut1.de as high-risk due to its active status, confirmed blocklist presence, and use of Cloudflare for potential evasion. Recommended actions include blocking the domain and IP at network perimeter controls, monitoring for connections to 172.67.72.207, and reviewing logs for any successful access attempts. Further analysis of the post-challenge content is required to determine the exact phishing payload or target.