mail[.]bqnbsix[.]rumahsakit[.]de

mail.bqnbsix.rumahsakit.de is currently active and classified as a high‑risk generic phishing infrastructure. The domain resolves to the IPv4 address 103.52.114.215 and is delegated to Cloudflare nameservers aldo.ns.cloudflare.com and pat.ns.cloudflare.com. It appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans have recorded 12 out of 95 security‑vendor detections flagging the domain as malicious.

The limited intelligence indicates that the operator is leveraging Cloudflare’s DNS service to obscure the true hosting environment, a common tactic for phishing campaigns. No SSL/TLS certificate details, HTTP status codes, page titles, or explicit brand targets have been published, leaving the exact content and victim‑lure mechanism unknown. The absence of these data points prevents confirmation of the specific credential‑stealing page or the targeted organization. Defenders should treat the domain as hostile: add the domain and its resolved IP address to network and endpoint blocklists, enforce DNS filtering, and monitor for any outbound connections to the IP.

Email security gateways should be configured to quarantine messages that reference this domain. Continuous re‑inspection of the domain with sandbox and URL‑reputation services is advised to capture any evolution in payload or credential‑harvesting pages. Organizations using threat‑intelligence feeds should prioritize this indicator given its high risk rating and active status.