Campaign board · filed 2026-09-02
Hosts sharing the ap-ocdc.app kit
91 hosts76 domains5 networks7 confirmed kitsighted 2026-01-30 → 2026-08-26
Opened from the case apoBank QR letter → suspected phishing panel on GHOSTnet, 91 domains (ap-ocdc[.]app).
Docket 91 hosts
confirmed kit · 7
01aktualisierun-apo[.]appconfirmed kitlive2026-08-18
Live response reproduces the Next.js kit, build -RsevR6KUB8IDNx2FX59E fingerprint: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
kit=92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 matched=Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
GET hxxps://aktualisierun-apo[.]app/; compare sha256 of the body, "buildId" in the body and the Server / X-Powered-By / Set-Cookie headers against kit lead 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Observed Answers HTTP 404 from cloudflare with X-Powered-By: Next.js
state=live http=404 a=5.231.5.142 mx=0 final=hxxps://aktualisierun-apo[.]app/ sha256=6082f6fec1b2aa3bd118c68dbe7c373e564567b9d29d44b5f8538f0603f63c43 bytes=1437 build_id=5gr_cQEyCJxxw-Nbs61pb server=cloudflare powered_by=Next.js set_cookie=visited_aktualisierun-apo_app=true
GET hxxps://aktualisierun-apo[.]app/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=aktualisierun-apo[.]app&type=A|MX; when both are empty, https://rdap.org/domain/aktualisierun-apo[.]app decides registered vs gone · Observed Registered via GNAME.COM PTE. LTD. (IANA 1923); abuse contact legal@gname.com
registrar=GNAME.COM PTE. LTD. iana_id=1923 abuse=legal@gname.com
GET https://rdap.org/domain/aktualisierun-apo[.]app (redirected to https://pubapi.registry.google/rdap/domain/aktualisierun-apo[.]app); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/aktualisierun-apo[.]app (redirected to https://pubapi.registry.google/rdap/domain/aktualisierun-apo[.]app); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourcekit fingerprint on GET hxxps://aktualisierun-apo[.]app/: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_* match kit 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Strings name resembles Deutsche Apotheker- und Ärztebank (apoB… · same kit 92ca5c85ab78… · resolves to 5.231.5.238 · in network GHOSTnet GmbH · registered via GNAME.COM PTE. LTD. · ns at dnspod.com · resolves to 5.231.5.142
- Reported to Google Registry / Charleston Road Registry — .app registry abuse on
02ap-ocdc[.]comconfirmed kitlive2026-08-18
Live response reproduces the Next.js kit, build -RsevR6KUB8IDNx2FX59E fingerprint: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
kit=92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 matched=Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
GET hxxps://ap-ocdc[.]com/; compare sha256 of the body, "buildId" in the body and the Server / X-Powered-By / Set-Cookie headers against kit lead 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Observed Answers HTTP 404 from cloudflare with X-Powered-By: Next.js
state=live http=404 a=5.231.5.9 mx=0 final=hxxps://ap-ocdc[.]com/ sha256=12b381c353bd10ac624c7ed8e2fc4c28090af6209b14c6cce8621312b76a420e bytes=1437 build_id=KAfnY4jK-pP40sX46xVCp server=cloudflare powered_by=Next.js set_cookie=visited_ap-ocdc_com=true
GET hxxps://ap-ocdc[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=ap-ocdc[.]com&type=A|MX; when both are empty, https://rdap.org/domain/ap-ocdc[.]com decides registered vs gone · Observed Registered via Realtime Register B.V. (IANA 839); abuse contact rtr-security-threats@realtimeregister.com
registrar=Realtime Register B.V. iana_id=839 abuse=rtr-security-threats@realtimeregister.com
GET https://rdap.org/domain/ap-ocdc[.]com (redirected to https://rdap.verisign.com/com/v1/domain/ap-ocdc[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/ap-ocdc[.]com (redirected to https://rdap.verisign.com/com/v1/domain/ap-ocdc[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourcekit fingerprint on GET hxxps://ap-ocdc[.]com/: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_* match kit 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Strings resolves to 5.231.2.229 · same kit 92ca5c85ab78… · in network GHOSTnet GmbH · ns at dnspod.com · registered via Realtime Register B.V. · resolves to 5.231.5.9
03bbvaseguridad[.]comconfirmed kitlive2026-04-29
Live response reproduces the Next.js kit, build -RsevR6KUB8IDNx2FX59E fingerprint: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
kit=92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 matched=Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
GET hxxps://bbvaseguridad[.]com/; compare sha256 of the body, "buildId" in the body and the Server / X-Powered-By / Set-Cookie headers against kit lead 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Observed Answers HTTP 404 from cloudflare with X-Powered-By: Next.js
state=live http=404 a=5.231.1.132 mx=0 final=hxxps://bbvaseguridad[.]com/ sha256=6082f6fec1b2aa3bd118c68dbe7c373e564567b9d29d44b5f8538f0603f63c43 bytes=1437 build_id=5gr_cQEyCJxxw-Nbs61pb server=cloudflare powered_by=Next.js set_cookie=visited_bbvaseguridad_com=true
GET hxxps://bbvaseguridad[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=bbvaseguridad[.]com&type=A|MX; when both are empty, https://rdap.org/domain/bbvaseguridad[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/bbvaseguridad[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bbvaseguridad[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/bbvaseguridad[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bbvaseguridad[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourcekit fingerprint on GET hxxps://bbvaseguridad[.]com/: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_* match kit 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Strings name resembles BBVA · resolves to 2a00:12d8:700e:0:d3cf:83a0:36c:b87a · resolves to 5.230.77.213 · same kit 92ca5c85ab78… · resolves to 5.231.3.201 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Global Domain Group LLC · resolves to 5.231.1.132
archived copy in the Wayback Machine
04bnb-wiederherstellung[.]comconfirmed kitlive2026-02-13 → 2026-04-12
Live response reproduces the Next.js kit, build -RsevR6KUB8IDNx2FX59E fingerprint: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
kit=92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 matched=Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
GET hxxps://bnb-wiederherstellung[.]com/; compare sha256 of the body, "buildId" in the body and the Server / X-Powered-By / Set-Cookie headers against kit lead 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Observed Answers HTTP 404 from cloudflare with X-Powered-By: Next.js
state=live http=404 a=5.231.1.132 mx=0 final=hxxps://bnb-wiederherstellung[.]com/ sha256=6082f6fec1b2aa3bd118c68dbe7c373e564567b9d29d44b5f8538f0603f63c43 bytes=1437 build_id=5gr_cQEyCJxxw-Nbs61pb server=cloudflare powered_by=Next.js set_cookie=visited_bnb-wiederherstellung_com=true
GET hxxps://bnb-wiederherstellung[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=bnb-wiederherstellung[.]com&type=A|MX; when both are empty, https://rdap.org/domain/bnb-wiederherstellung[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/bnb-wiederherstellung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bnb-wiederherstellung[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/bnb-wiederherstellung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bnb-wiederherstellung[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourcekit fingerprint on GET hxxps://bnb-wiederherstellung[.]com/: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_* match kit 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Strings name resembles BNB · resolves to 5.230.73.235 · resolves to 185.181.8.54 · same kit 92ca5c85ab78… · resolves to 5.231.3.201 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp · resolves to 5.231.1.132
05bnb-recovery[.]comconfirmed kitlive2026-01-30 → 2026-02-02
Live response reproduces the Next.js kit, build -RsevR6KUB8IDNx2FX59E fingerprint: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
kit=92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 matched=Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_*
GET hxxps://bnb-recovery[.]com/; compare sha256 of the body, "buildId" in the body and the Server / X-Powered-By / Set-Cookie headers against kit lead 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Observed Answers HTTP 404 from cloudflare with X-Powered-By: Next.js
state=live http=404 a=5.231.1.132 mx=0 final=hxxps://bnb-recovery[.]com/ sha256=6082f6fec1b2aa3bd118c68dbe7c373e564567b9d29d44b5f8538f0603f63c43 bytes=1437 build_id=5gr_cQEyCJxxw-Nbs61pb server=cloudflare powered_by=Next.js set_cookie=visited_bnb-recovery_com=true
GET hxxps://bnb-recovery[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=bnb-recovery[.]com&type=A|MX; when both are empty, https://rdap.org/domain/bnb-recovery[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/bnb-recovery[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bnb-recovery[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/bnb-recovery[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bnb-recovery[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourcekit fingerprint on GET hxxps://bnb-recovery[.]com/: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_* match kit 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 · Strings name resembles BNB · resolves to 5.230.55.107 · same kit 92ca5c85ab78… · resolves to 5.231.3.201 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp · resolves to 5.231.1.132
06private.bestsuite[.]ccconfirmed kitlive
Answers HTTP 200 from cloudflare with X-Powered-By: Next.js
state=live http=200 a=5.231.3.156 mx=0 final=hxxps://private[.]bestsuite[.]cc/ sha256=08375e7de5f1c1575b0dd6578f270cde43770c956762aa4f9ada94c4a2d83818 bytes=3434 build_id=5gr_cQEyCJxxw-Nbs61pb server=cloudflare powered_by=Next.js set_cookie=-
GET hxxps://private[.]bestsuite[.]cc/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=private[.]bestsuite[.]cc&type=A|MX; when both are empty, https://rdap.org/domain/private[.]bestsuite[.]cc decides registered vs gone · Observed Registered via Internet Domain Service BS Corp (IANA 2487); abuse contact abuse@internet.bs
registrar=Internet Domain Service BS Corp iana_id=2487 abuse=abuse@internet.bs
GET https://rdap.org/domain/bestsuite[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/bestsuite[.]cc); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/bestsuite[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/bestsuite[.]cc); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourcecaptured 20260825T124503Z: HTTP 200 from nginx/1.26.3, X-Powered-By: Next.js, buildId -RsevR6KUB8IDNx2FX59E identical to the anchor host (finding bestsuite-cc-same-codebase-same-ip) · Strings same kit 92ca5c85ab78… · resolves to 5.231.1.251 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Internet Domain Service BS Corp · resolves to 5.231.3.156
07ap-ocdc[.]appconfirmed kitdns pulled2026-08-26
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://ap-ocdc[.]app/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://ap-ocdc[.]app/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=ap-ocdc[.]app&type=A|MX; when both are empty, https://rdap.org/domain/ap-ocdc[.]app decides registered vs gone · Observed Registered via GNAME.COM PTE. LTD. (IANA 1923); abuse contact legal@gname.com
registrar=GNAME.COM PTE. LTD. iana_id=1923 abuse=legal@gname.com
GET https://rdap.org/domain/ap-ocdc[.]app (redirected to https://pubapi.registry.google/rdap/domain/ap-ocdc[.]app); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/ap-ocdc[.]app (redirected to https://pubapi.registry.google/rdap/domain/ap-ocdc[.]app); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourcethe case's own target; every check on the case sheet is about this host · Strings same kit 92ca5c85ab78… · registered via GNAME.COM PTE. LTD. · ns at share-dns.com · ns at share-dns.net
- Reported to Google Registry / Charleston Road Registry — .app registry abuse on
archived copy in the Wayback Machine
correlated · 84
08o2online-portal[.]comcorrelatedlive2026-05-12 → 2026-08-09
Answers HTTP 200 from cloudflare — title "href[.]li"
state=live http=200 a=5.231.3.201 mx=0 final=hxxps://href[.]li/?https://wikipedia.de sha256=8eb937180e435dbf32c1865bfc36c1d52f9e338789549cd2d1dc33ff4b2563dc bytes=420 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://o2online-portal[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=o2online-portal[.]com&type=A|MX; when both are empty, https://rdap.org/domain/o2online-portal[.]com decides registered vs gone · Observed GET hxxps://o2online-portal[.]com/ redirected to href[.]li; the response was not compared with the kit
final=hxxps://href[.]li/?https://wikipedia.de status=200
GET hxxps://o2online-portal[.]com/ (redirects followed); compare the final URL's host with the lead · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/o2online-portal[.]com (redirected to https://rdap.verisign.com/com/v1/domain/o2online-portal[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/o2online-portal[.]com (redirected to https://rdap.verisign.com/com/v1/domain/o2online-portal[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 2a00:12d8:700e:0:691a:8670:e842:b864 · redirected via href[.]li · in network GHOSTnet GmbH · resolves to 5.231.3.201 · ns at dnspod.com · registered via Hello Internet Corp
09bestsuite[.]cccorrelatedlive
Answers HTTP 200 from cloudflare with X-Powered-By: Next.js
state=live http=200 a=5.231.1.251 mx=0 final=hxxps://private[.]bestsuite[.]cc/ sha256=52a9e34bdfda72a57214006a191e509a2d158595c9e0a2b68fa66f4850b6815f bytes=3434 build_id=KAfnY4jK-pP40sX46xVCp server=cloudflare powered_by=Next.js set_cookie=-
GET hxxps://bestsuite[.]cc/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=bestsuite[.]cc&type=A|MX; when both are empty, https://rdap.org/domain/bestsuite[.]cc decides registered vs gone · Observed Registered via Internet Domain Service BS Corp (IANA 2487); abuse contact abuse@internet.bs
registrar=Internet Domain Service BS Corp iana_id=2487 abuse=abuse@internet.bs
GET https://rdap.org/domain/bestsuite[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/bestsuite[.]cc); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/bestsuite[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/bestsuite[.]cc); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings in network GHOSTnet GmbH · ns at dnspod.com · registered via Internet Domain Service BS Corp · resolves to 5.231.1.251
archived copy in the Wayback Machine
10href[.]licorrelatedlive
Answers HTTP 200 from cloudflare — title "href[.]li: hide your referrer"
state=live http=200 a=192.0.78.26,192.0.78.27 mx=0 final=hxxps://href[.]li/ sha256=2178fd99c052e9ee3b197db8a0e488b2b1dfc2c287e2786dbae9e575a9466d24 bytes=1808 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://href[.]li/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=href[.]li&type=A|MX; when both are empty, https://rdap.org/domain/href[.]li decides registered vs gone · Observed Strings resolves to 192.0.78.26 · in network Automattic, Inc · resolves to 192.0.78.27 · ← redirected via o2online-portal[.]com
archived copy in the Wayback Machine
11m.ap-ocdc[.]comcorrelatedoffline2026-08-20
Resolves but gives no usable HTTP response: TimeoutError: The operation was aborted due to timeout
state=http_dead http=- a=5.231.5.9 mx=0 final=- sha256=- bytes=- build_id=- server=- powered_by=- set_cookie=-
GET hxxps://m[.]ap-ocdc[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]ap-ocdc[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]ap-ocdc[.]com decides registered vs gone · Observed Registered via Realtime Register B.V. (IANA 839); abuse contact rtr-security-threats@realtimeregister.com
registrar=Realtime Register B.V. iana_id=839 abuse=rtr-security-threats@realtimeregister.com
GET https://rdap.org/domain/ap-ocdc[.]com (redirected to https://rdap.verisign.com/com/v1/domain/ap-ocdc[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/ap-ocdc[.]com (redirected to https://rdap.verisign.com/com/v1/domain/ap-ocdc[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.231.2.228 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Realtime Register B.V. · resolves to 5.231.5.9
12apo-aktualisierung[.]comcorrelateddns pulled2026-08-12 → 2026-08-14
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-aktualisierung[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-aktualisierung[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-aktualisierung[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-aktualisierung[.]com decides registered vs gone · Observed Registered via GMO Internet Group, Inc. d/b/a Onamae.com (IANA 49); abuse contact abuse@internet.gmo
registrar=GMO Internet Group, Inc. d/b/a Onamae.com iana_id=49 abuse=abuse@internet.gmo
GET https://rdap.org/domain/apo-aktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktualisierung[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-aktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktualisierung[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.231.3.223 · resolves to 5.231.4.214 · in network GHOSTnet GmbH · ns at dnspod.com · registered via GMO Internet Group, Inc. d/b/a Onamae.c… · ← redirected via eddor[.]info · ← redirected via mitom[.]club
archived copy in the Wayback Machine
13eddor[.]infocorrelateddns pulled2026-08-14
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://eddor[.]info/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://eddor[.]info/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=eddor[.]info&type=A|MX; when both are empty, https://rdap.org/domain/eddor[.]info decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/eddor[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/eddor[.]info); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client renew prohibited, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client renew prohibited|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/eddor[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/eddor[.]info); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceEvery recorded scan of eddor[.]info landed on another site: apo-aktualisierung[.]com, www.google.com
apo-aktualisierung[.]com 01a00094-7ad7-7782-83eb-67efb7329414 www.google.com 0196da33-0a69-762b-ac91-480c7a19291e
GET https://urlscan.io/api/v1/search/?q=domain%3Aeddor.info&size=20; for scans with task.domain=eddor[.]info, compare page.domain · Observed · sourceStrings resolves to 5.231.3.223 · in network GHOSTnet GmbH · redirected via apo-aktualisierung[.]com · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
archived copy in the Wayback Machine
14mitom[.]clubcorrelateddns pulled2026-08-12
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://mitom[.]club/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://mitom[.]club/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=mitom[.]club&type=A|MX; when both are empty, https://rdap.org/domain/mitom[.]club decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/mitom[.]club (redirected to https://rdap.nic.club/domain/mitom[.]club); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client update prohibited, client delete prohibited, client transfer prohibited, client hold, client renew prohibited, server transfer prohibited — client hold: the registrar has placed the domain on hold
client update prohibited|client delete prohibited|client transfer prohibited|client hold|client renew prohibited|server transfer prohibited
GET https://rdap.org/domain/mitom[.]club (redirected to https://rdap.nic.club/domain/mitom[.]club); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceEvery recorded scan of mitom[.]club landed on another site: apo-aktualisierung[.]com, mitomtv1.us
apo-aktualisierung[.]com 019ff537-34b4-7362-8e89-22beacd4542c mitomtv1.us 2ea7cae1-f06c-4087-ad7a-34229c8c51c1
GET https://urlscan.io/api/v1/search/?q=domain%3Amitom.club&size=20; for scans with task.domain=mitom[.]club, compare page.domain · Observed · sourceStrings resolves to 5.231.4.214 · in network GHOSTnet GmbH · redirected via apo-aktualisierung[.]com · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
archived copy in the Wayback Machine
15golinks[.]infocorrelateddns pulled2026-08-04
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://golinks[.]info/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://golinks[.]info/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=golinks[.]info&type=A|MX; when both are empty, https://rdap.org/domain/golinks[.]info decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/golinks[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/golinks[.]info); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client renew prohibited, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client renew prohibited|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/golinks[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/golinks[.]info); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.231.5.207 · in network GHOSTnet GmbH · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
archived copy in the Wayback Machine
16connectwithyomyg[.]infocorrelateddns pulled2026-08-04
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://connectwithyomyg[.]info/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://connectwithyomyg[.]info/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=connectwithyomyg[.]info&type=A|MX; when both are empty, https://rdap.org/domain/connectwithyomyg[.]info decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/connectwithyomyg[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/connectwithyomyg[.]info); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client renew prohibited, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client renew prohibited|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/connectwithyomyg[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/connectwithyomyg[.]info); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceEvery recorded scan of connectwithyomyg[.]info landed on another site: apo-nunaktualisieren[.]com
apo-nunaktualisieren[.]com 019fcdd7-6393-7675-be13-7f321a95bab2
GET https://urlscan.io/api/v1/search/?q=domain%3Aconnectwithyomyg.info&size=20; for scans with task.domain=connectwithyomyg[.]info, compare page.domain · Observed · sourceStrings resolves to 5.231.5.207 · in network GHOSTnet GmbH · redirected via apo-nunaktualisieren[.]com · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
17apo-nunaktualisieren[.]comcorrelateddns pulled2026-07-11 → 2026-08-04
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-nunaktualisieren[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-nunaktualisieren[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-nunaktualisieren[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-nunaktualisieren[.]com decides registered vs gone · Observed Registered via Dominet (HK) Limited (IANA 3775); abuse contact domainabuse@service.aliyun.com
registrar=Dominet (HK) Limited iana_id=3775 abuse=domainabuse@service.aliyun.com
GET https://rdap.org/domain/apo-nunaktualisieren[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nunaktualisieren[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/apo-nunaktualisieren[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nunaktualisieren[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.28 · resolves to 5.231.5.203 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Dominet (HK) Limited · ← redirected via connectwithyomyg[.]info
18www.apo-nunaktualisieren[.]comcorrelateddomain gone2026-07-30
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apo-nunaktualisieren[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apo-nunaktualisieren[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apo-nunaktualisieren[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apo-nunaktualisieren[.]com decides registered vs gone · Observed Registered via Dominet (HK) Limited (IANA 3775); abuse contact domainabuse@service.aliyun.com
registrar=Dominet (HK) Limited iana_id=3775 abuse=domainabuse@service.aliyun.com
GET https://rdap.org/domain/apo-nunaktualisieren[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nunaktualisieren[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/apo-nunaktualisieren[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nunaktualisieren[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.47 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Dominet (HK) Limited
19apo-sicheres[.]comcorrelateddns pulled2026-07-21 → 2026-07-22
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-sicheres[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-sicheres[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-sicheres[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-sicheres[.]com decides registered vs gone · Observed Registered via Dominet (HK) Limited (IANA 3775); abuse contact domainabuse@service.aliyun.com
registrar=Dominet (HK) Limited iana_id=3775 abuse=domainabuse@service.aliyun.com
GET https://rdap.org/domain/apo-sicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-sicheres[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-sicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-sicheres[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.26 · resolves to 5.230.194.46 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Dominet (HK) Limited
20apobank[.]cocorrelateddomain gone2026-07-22
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://apobank[.]co/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apobank[.]co/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apobank[.]co&type=A|MX; when both are empty, https://rdap.org/domain/apobank[.]co decides registered vs gone · Observed Strings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.63 · in network GHOSTnet GmbH
archived copy in the Wayback Machine
21www.apo-sicheres[.]comcorrelateddomain gone2026-07-18
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apo-sicheres[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apo-sicheres[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apo-sicheres[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apo-sicheres[.]com decides registered vs gone · Observed Registered via Dominet (HK) Limited (IANA 3775); abuse contact domainabuse@service.aliyun.com
registrar=Dominet (HK) Limited iana_id=3775 abuse=domainabuse@service.aliyun.com
GET https://rdap.org/domain/apo-sicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-sicheres[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-sicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-sicheres[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.25 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Dominet (HK) Limited
22m.apo-sicheres[.]comcorrelateddomain gone2026-07-18
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]apo-sicheres[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]apo-sicheres[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]apo-sicheres[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]apo-sicheres[.]com decides registered vs gone · Observed Registered via Dominet (HK) Limited (IANA 3775); abuse contact domainabuse@service.aliyun.com
registrar=Dominet (HK) Limited iana_id=3775 abuse=domainabuse@service.aliyun.com
GET https://rdap.org/domain/apo-sicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-sicheres[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-sicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-sicheres[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.25 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Dominet (HK) Limited
23apo-datenlive[.]comcorrelateddns pulled2026-07-18
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-datenlive[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-datenlive[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-datenlive[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-datenlive[.]com decides registered vs gone · Observed Registered via Realtime Register B.V. (IANA 839); abuse contact rtr-security-threats@realtimeregister.com
registrar=Realtime Register B.V. iana_id=839 abuse=rtr-security-threats@realtimeregister.com
GET https://rdap.org/domain/apo-datenlive[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenlive[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-datenlive[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenlive[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.49 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Realtime Register B.V.
24apoaktualisierung[.]comcorrelateddns pulled2026-07-17
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apoaktualisierung[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apoaktualisierung[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apoaktualisierung[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apoaktualisierung[.]com decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apoaktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apoaktualisierung[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apoaktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apoaktualisierung[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.23 · in network GHOSTnet GmbH · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED
25aposicheres[.]comcorrelateddns pulled2026-07-12
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://aposicheres[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://aposicheres[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=aposicheres[.]com&type=A|MX; when both are empty, https://rdap.org/domain/aposicheres[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/aposicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/aposicheres[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/aposicheres[.]com (redirected to https://rdap.verisign.com/com/v1/domain/aposicheres[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.28 · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
26m.apo-aktueller[.]comcorrelateddomain gone2026-07-11
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]apo-aktueller[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]apo-aktueller[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]apo-aktueller[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]apo-aktueller[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/apo-aktueller[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktueller[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-aktueller[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktueller[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.28 · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
27daten-apo-aktuell[.]comcorrelateddns pulled2026-07-10
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://daten-apo-aktuell[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://daten-apo-aktuell[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=daten-apo-aktuell[.]com&type=A|MX; when both are empty, https://rdap.org/domain/daten-apo-aktuell[.]com decides registered vs gone · Observed Registered via Dominet (HK) Limited (IANA 3775); abuse contact domainabuse@service.aliyun.com
registrar=Dominet (HK) Limited iana_id=3775 abuse=domainabuse@service.aliyun.com
GET https://rdap.org/domain/daten-apo-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/daten-apo-aktuell[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/daten-apo-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/daten-apo-aktuell[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.249 · in network GHOSTnet GmbH · registered via Dominet (HK) Limited · ns at cloudflare.com
28apo-aktueller[.]comcorrelateddns pulled2026-07-10
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-aktueller[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-aktueller[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-aktueller[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-aktueller[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/apo-aktueller[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktueller[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-aktueller[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktueller[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.29 · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
29apo-datenaktuelles[.]comcorrelateddns pulled2026-07-07 → 2026-07-09
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-datenaktuelles[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-datenaktuelles[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-datenaktuelles[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-datenaktuelles[.]com decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apo-datenaktuelles[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenaktuelles[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apo-datenaktuelles[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenaktuelles[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.246 · in network GHOSTnet GmbH · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED
30m.apo-nun-aktuell[.]comcorrelateddomain gone2026-07-09
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]apo-nun-aktuell[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]apo-nun-aktuell[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]apo-nun-aktuell[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]apo-nun-aktuell[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/apo-nun-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nun-aktuell[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-nun-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nun-aktuell[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.29 · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
31apo-nun-aktuell[.]comcorrelateddns pulled2026-07-09
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-nun-aktuell[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-nun-aktuell[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-nun-aktuell[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-nun-aktuell[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/apo-nun-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nun-aktuell[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-nun-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-nun-aktuell[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.29 · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
32www.apo-daten-aktuell[.]comcorrelateddomain gone2026-07-05
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apo-daten-aktuell[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apo-daten-aktuell[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apo-daten-aktuell[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apo-daten-aktuell[.]com decides registered vs gone · Observed Registered via Realtime Register B.V. (IANA 839); abuse contact rtr-security-threats@realtimeregister.com
registrar=Realtime Register B.V. iana_id=839 abuse=rtr-security-threats@realtimeregister.com
GET https://rdap.org/domain/apo-daten-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-daten-aktuell[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-daten-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-daten-aktuell[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.243 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Realtime Register B.V.
33daten-aktuell-apo[.]comcorrelateddns pulled2026-07-03
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://daten-aktuell-apo[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://daten-aktuell-apo[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=daten-aktuell-apo[.]com&type=A|MX; when both are empty, https://rdap.org/domain/daten-aktuell-apo[.]com decides registered vs gone · Observed Registered via Realtime Register B.V. (IANA 839); abuse contact rtr-security-threats@realtimeregister.com
registrar=Realtime Register B.V. iana_id=839 abuse=rtr-security-threats@realtimeregister.com
GET https://rdap.org/domain/daten-aktuell-apo[.]com (redirected to https://rdap.verisign.com/com/v1/domain/daten-aktuell-apo[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/daten-aktuell-apo[.]com (redirected to https://rdap.verisign.com/com/v1/domain/daten-aktuell-apo[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.243 · resolves to 2a00:b700:3::3:3d9 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Realtime Register B.V. · in network LLC Baxet
34apo-daten-aktuell[.]comcorrelateddns pulled2026-07-03
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-daten-aktuell[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-daten-aktuell[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-daten-aktuell[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-daten-aktuell[.]com decides registered vs gone · Observed Registered via Realtime Register B.V. (IANA 839); abuse contact rtr-security-threats@realtimeregister.com
registrar=Realtime Register B.V. iana_id=839 abuse=rtr-security-threats@realtimeregister.com
GET https://rdap.org/domain/apo-daten-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-daten-aktuell[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-daten-aktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-daten-aktuell[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.243 · resolves to 2a00:b700:3::3:3d9 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Realtime Register B.V. · in network LLC Baxet
35apoverifikation[.]comcorrelateddns pulled2026-06-25 → 2026-06-29
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apoverifikation[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apoverifikation[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apoverifikation[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apoverifikation[.]com decides registered vs gone · Observed Registered via Metaregistrar BV (IANA 2288); abuse contact abuse@metaregistrar.com
registrar=Metaregistrar BV iana_id=2288 abuse=abuse@metaregistrar.com
GET https://rdap.org/domain/apoverifikation[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apoverifikation[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apoverifikation[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apoverifikation[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.210 · resolves to 5.230.194.212 · resolves to 5.230.194.213 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Metaregistrar BV
36apo-kundeninfo[.]comcorrelateddns pulled2026-06-26
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-kundeninfo[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-kundeninfo[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-kundeninfo[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-kundeninfo[.]com decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apo-kundeninfo[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kundeninfo[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apo-kundeninfo[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kundeninfo[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.211 · in network GHOSTnet GmbH · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED
37apo-kundenverifizierung[.]comcorrelateddns pulled2026-06-24 → 2026-06-25
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-kundenverifizierung[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-kundenverifizierung[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-kundenverifizierung[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-kundenverifizierung[.]com decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apo-kundenverifizierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kundenverifizierung[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apo-kundenverifizierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kundenverifizierung[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.210 · resolves to 5.230.194.120 · in network GHOSTnet GmbH · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED
38apo-verfizierung[.]comcorrelateddns pulled2026-06-25
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-verfizierung[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-verfizierung[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-verfizierung[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-verfizierung[.]com decides registered vs gone · Observed Registered via Metaregistrar BV (IANA 2288); abuse contact abuse@metaregistrar.com
registrar=Metaregistrar BV iana_id=2288 abuse=abuse@metaregistrar.com
GET https://rdap.org/domain/apo-verfizierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-verfizierung[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-verfizierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-verfizierung[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.120 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Metaregistrar BV
39apo-kundencenter[.]comcorrelateddns pulled2026-06-25
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-kundencenter[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-kundencenter[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-kundencenter[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-kundencenter[.]com decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apo-kundencenter[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kundencenter[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apo-kundencenter[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kundencenter[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.120 · in network GHOSTnet GmbH · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED
40apo-verifikationen[.]comcorrelateddns pulled2026-06-24
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-verifikationen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-verifikationen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-verifikationen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-verifikationen[.]com decides registered vs gone · Observed Registered via Metaregistrar BV (IANA 2288); abuse contact abuse@metaregistrar.com
registrar=Metaregistrar BV iana_id=2288 abuse=abuse@metaregistrar.com
GET https://rdap.org/domain/apo-verifikationen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-verifikationen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-verifikationen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-verifikationen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.120 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Metaregistrar BV
41apo-verifikation[.]cccorrelateddns pulled2026-06-20 → 2026-06-22
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-verifikation[.]cc/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-verifikation[.]cc/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-verifikation[.]cc&type=A|MX; when both are empty, https://rdap.org/domain/apo-verifikation[.]cc decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apo-verifikation[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/apo-verifikation[.]cc); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apo-verifikation[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/apo-verifikation[.]cc); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.194.117 · in network GHOSTnet GmbH · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED
42apo-updates[.]comcorrelateddns pulled2026-05-29 → 2026-06-09
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-updates[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-updates[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-updates[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-updates[.]com decides registered vs gone · Observed Registered via Gname.com Pte. Ltd. (IANA 1923); abuse contact complaint@gname.com
registrar=Gname.com Pte. Ltd. iana_id=1923 abuse=complaint@gname.com
GET https://rdap.org/domain/apo-updates[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-updates[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-updates[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-updates[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.70.111 · resolves to 5.230.70.133 · in network GHOSTnet GmbH · registered via GNAME.COM PTE. LTD. · ns at share-dns.com · ns at share-dns.net
43apo-einloggen[.]comcorrelateddns pulled2026-05-27
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-einloggen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-einloggen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-einloggen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-einloggen[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apo-einloggen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-einloggen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-einloggen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-einloggen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.69.30 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
44poba-servicehilfe[.]comcorrelateddns pulled2026-05-26
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://poba-servicehilfe[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://poba-servicehilfe[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=poba-servicehilfe[.]com&type=A|MX; when both are empty, https://rdap.org/domain/poba-servicehilfe[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/poba-servicehilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/poba-servicehilfe[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/poba-servicehilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/poba-servicehilfe[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.73.235 · name resembles Postbank · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
45apo-datenaktualisierung[.]comcorrelatedoffline2026-05-26
Resolves but gives no usable HTTP response: TimeoutError: The operation was aborted due to timeout
state=http_dead http=- a=5.231.3.201 mx=0 final=- sha256=- bytes=- build_id=- server=- powered_by=- set_cookie=-
GET hxxps://apo-datenaktualisierung[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-datenaktualisierung[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-datenaktualisierung[.]com decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apo-datenaktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenaktualisierung[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client transfer prohibited
client delete prohibited|client transfer prohibited
GET https://rdap.org/domain/apo-datenaktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenaktualisierung[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.73.235 · in network GHOSTnet GmbH · resolves to 5.231.3.201 · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED
46www.apo-vervollstaendigen[.]comcorrelateddomain gone2026-05-24
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apo-vervollstaendigen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apo-vervollstaendigen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apo-vervollstaendigen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apo-vervollstaendigen[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apo-vervollstaendigen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-vervollstaendigen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-vervollstaendigen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-vervollstaendigen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.73.235 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
47m.apo-datenaktuell[.]comcorrelateddomain gone2026-05-21
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]apo-datenaktuell[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]apo-datenaktuell[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]apo-datenaktuell[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]apo-datenaktuell[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/apo-datenaktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenaktuell[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-datenaktuell[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-datenaktuell[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 2a00:12d8:700e:0:205b:7465:29df:c305 · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
48m.apo-formulare[.]comcorrelateddomain gone2026-05-17
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]apo-formulare[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]apo-formulare[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]apo-formulare[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]apo-formulare[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apo-formulare[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-formulare[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-formulare[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-formulare[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.55.152 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
49www.apo-formulare[.]comcorrelateddomain gone2026-05-17
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apo-formulare[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apo-formulare[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apo-formulare[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apo-formulare[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apo-formulare[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-formulare[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-formulare[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-formulare[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.55.152 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
50apo-formular[.]comcorrelateddns pulled2026-05-13
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-formular[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-formular[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-formular[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-formular[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apo-formular[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-formular[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-formular[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-formular[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 2a00:12d8:700e:0:f14a:3a4c:265a:ecfa · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
51ypsumk[.]infocorrelateddns pulled2026-05-13
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://ypsumk[.]info/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://ypsumk[.]info/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=ypsumk[.]info&type=A|MX; when both are empty, https://rdap.org/domain/ypsumk[.]info decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/ypsumk[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/ypsumk[.]info); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client renew prohibited, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client renew prohibited|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/ypsumk[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/ypsumk[.]info); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 2a00:12d8:700e:0:f14a:3a4c:265a:ecfa · in network GHOSTnet GmbH · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
archived copy in the Wayback Machine
52apo-verifikation[.]comcorrelateddns pulled2026-05-10 → 2026-05-12
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-verifikation[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-verifikation[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-verifikation[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-verifikation[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/apo-verifikation[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-verifikation[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-verifikation[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-verifikation[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 2a00:12d8:700e:0:691a:8670:e842:b864 · resolves to 5.230.77.135 · resolves to 5.230.77.136 · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
53apo-bank-updates[.]comcorrelateddns pulled2026-04-22 → 2026-05-12
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-bank-updates[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-bank-updates[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-bank-updates[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-bank-updates[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/apo-bank-updates[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-updates[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-bank-updates[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-updates[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 2a00:12d8:700e:0:a9cb:7a0b:527c:fabe · resolves to 5.230.55.150 · in network GHOSTnet GmbH · registered via Global Domain Group LLC
54www.apoverifizieren[.]comcorrelateddomain gone2026-05-09
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apoverifizieren[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apoverifizieren[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apoverifizieren[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apoverifizieren[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apoverifizieren[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apoverifizieren[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apoverifizieren[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apoverifizieren[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 2a00:12d8:700e:0:8b21:dc1a:d321:3a6c · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
55apobanken[.]comcorrelateddns pulled2026-05-06
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apobanken[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apobanken[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apobanken[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apobanken[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apobanken[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apobanken[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apobanken[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apobanken[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.76.254 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
56frfe[.]infocorrelateddns pulled2026-05-04
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://frfe[.]info/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://frfe[.]info/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=frfe[.]info&type=A|MX; when both are empty, https://rdap.org/domain/frfe[.]info decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/frfe[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/frfe[.]info); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client renew prohibited, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client renew prohibited|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/frfe[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/frfe[.]info); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.75.78 · in network GHOSTnet GmbH · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
archived copy in the Wayback Machine
57urwltu[.]infocorrelateddns pulled2026-05-04
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://urwltu[.]info/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://urwltu[.]info/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=urwltu[.]info&type=A|MX; when both are empty, https://rdap.org/domain/urwltu[.]info decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/urwltu[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/urwltu[.]info); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client renew prohibited, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client renew prohibited|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/urwltu[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/urwltu[.]info); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.75.78 · in network GHOSTnet GmbH · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
archived copy in the Wayback Machine
58emuz[.]infocorrelateddns pulled2026-05-04
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://emuz[.]info/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://emuz[.]info/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=emuz[.]info&type=A|MX; when both are empty, https://rdap.org/domain/emuz[.]info decides registered vs gone · Observed Registered via PDR Ltd. d/b/a PublicDomainRegistry.com (IANA 303); abuse contact abuse@publicdomainregistry.com
registrar=PDR Ltd. d/b/a PublicDomainRegistry.com iana_id=303 abuse=abuse@publicdomainregistry.com
GET https://rdap.org/domain/emuz[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/emuz[.]info); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client renew prohibited, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client renew prohibited|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/emuz[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/emuz[.]info); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.75.78 · in network GHOSTnet GmbH · registered via PDR Ltd. d/b/a PublicDomainRegistry.com · ns at suspended-domain.com
archived copy in the Wayback Machine
59m.apo-kunde[.]comcorrelateddomain gone2026-05-01
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]apo-kunde[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]apo-kunde[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]apo-kunde[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]apo-kunde[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/apo-kunde[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kunde[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-kunde[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-kunde[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 2a00:12d8:700e:0:a6e5:ebd4:2b71:a79b · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
60www.cd-uberprufen[.]comcorrelateddomain gone2026-04-29
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]cd-uberprufen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]cd-uberprufen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]cd-uberprufen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]cd-uberprufen[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/cd-uberprufen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/cd-uberprufen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/cd-uberprufen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/cd-uberprufen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 2a00:12d8:700e:0:d3cf:83a0:36c:b87a · name resembles comdirect · in network GHOSTnet GmbH · registered via Global Domain Group LLC
61cd-uberprufen[.]comcorrelateddns pulled2026-04-29
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://cd-uberprufen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://cd-uberprufen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=cd-uberprufen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/cd-uberprufen[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/cd-uberprufen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/cd-uberprufen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/cd-uberprufen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/cd-uberprufen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles comdirect · resolves to 5.230.77.213 · in network GHOSTnet GmbH · registered via Global Domain Group LLC
62m.consors-portalhilfe[.]comcorrelateddomain gone2026-04-27
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]consors-portalhilfe[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]consors-portalhilfe[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]consors-portalhilfe[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]consors-portalhilfe[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/consors-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/consors-portalhilfe[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/consors-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/consors-portalhilfe[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.73.41 · name resembles Consorsbank · in network GHOSTnet GmbH · registered via Global Domain Group LLC
63www.consors-portalhilfe[.]comcorrelateddomain gone2026-04-27
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]consors-portalhilfe[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]consors-portalhilfe[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]consors-portalhilfe[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]consors-portalhilfe[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/consors-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/consors-portalhilfe[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/consors-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/consors-portalhilfe[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.73.41 · name resembles Consorsbank · in network GHOSTnet GmbH · registered via Global Domain Group LLC
64mailer-nfity[.]comcorrelateddns pulled2026-04-26
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://mailer-nfity[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://mailer-nfity[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=mailer-nfity[.]com&type=A|MX; when both are empty, https://rdap.org/domain/mailer-nfity[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/mailer-nfity[.]com (redirected to https://rdap.verisign.com/com/v1/domain/mailer-nfity[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/mailer-nfity[.]com (redirected to https://rdap.verisign.com/com/v1/domain/mailer-nfity[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.76.65 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
65comdi-portalhilfe[.]comcorrelateddns pulled2026-04-23
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://comdi-portalhilfe[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://comdi-portalhilfe[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=comdi-portalhilfe[.]com&type=A|MX; when both are empty, https://rdap.org/domain/comdi-portalhilfe[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/comdi-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/comdi-portalhilfe[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/comdi-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/comdi-portalhilfe[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles comdirect · resolves to 5.230.75.239 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
66www.apo-bank-updates[.]comcorrelateddomain gone2026-04-22
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apo-bank-updates[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apo-bank-updates[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apo-bank-updates[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apo-bank-updates[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/apo-bank-updates[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-updates[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-bank-updates[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-updates[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 2a00:12d8:700e:0:a9cb:7a0b:527c:fabe · in network GHOSTnet GmbH · registered via Global Domain Group LLC
67www.cd-ueberpruefung[.]comcorrelateddomain gone2026-04-22
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]cd-ueberpruefung[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]cd-ueberpruefung[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]cd-ueberpruefung[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]cd-ueberpruefung[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/cd-ueberpruefung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/cd-ueberpruefung[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/cd-ueberpruefung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/cd-ueberpruefung[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles comdirect · resolves to 5.230.75.212 · in network GHOSTnet GmbH · registered via Global Domain Group LLC
68spk-sicherheit[.]comcorrelateddns pulled2026-04-03 → 2026-04-12
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://spk-sicherheit[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://spk-sicherheit[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=spk-sicherheit[.]com&type=A|MX; when both are empty, https://rdap.org/domain/spk-sicherheit[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/spk-sicherheit[.]com (redirected to https://rdap.verisign.com/com/v1/domain/spk-sicherheit[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/spk-sicherheit[.]com (redirected to https://rdap.verisign.com/com/v1/domain/spk-sicherheit[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Sparkasse · resolves to 2a00:12d8:700e:0:c873:b5da:4832:7a5c · resolves to 5.230.55.19 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
archived copy in the Wayback Machine
69o2-supporthilfe[.]comcorrelateddns pulled2026-04-12
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://o2-supporthilfe[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://o2-supporthilfe[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=o2-supporthilfe[.]com&type=A|MX; when both are empty, https://rdap.org/domain/o2-supporthilfe[.]com decides registered vs gone · Observed Registered via CNOBIN INFORMATION TECHNOLOGY LIMITED (IANA 3254); abuse contact abuse@ordertld.com
registrar=CNOBIN INFORMATION TECHNOLOGY LIMITED iana_id=3254 abuse=abuse@ordertld.com
GET https://rdap.org/domain/o2-supporthilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/o2-supporthilfe[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client transfer prohibited
client transfer prohibited
GET https://rdap.org/domain/o2-supporthilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/o2-supporthilfe[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.73.235 · name resembles o2 / Telefónica Germany · in network GHOSTnet GmbH · ns at dnspod.com · registered via CNOBIN INFORMATION TECHNOLOGY LIMITED
70bancacceso[.]comcorrelateddns pulled2026-04-07
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://bancacceso[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://bancacceso[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=bancacceso[.]com&type=A|MX; when both are empty, https://rdap.org/domain/bancacceso[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/bancacceso[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bancacceso[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/bancacceso[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bancacceso[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.55.19 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
71www.commerz-stornierungen[.]comcorrelateddomain gone2026-04-07
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]commerz-stornierungen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]commerz-stornierungen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]commerz-stornierungen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]commerz-stornierungen[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/commerz-stornierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-stornierungen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/commerz-stornierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-stornierungen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 2a00:12d8:700e:0:2b73:f27c:3a5c:9436 · name resembles Commerzbank · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
72bancoaccesso[.]comcorrelateddns pulled2026-04-07
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://bancoaccesso[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://bancoaccesso[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=bancoaccesso[.]com&type=A|MX; when both are empty, https://rdap.org/domain/bancoaccesso[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/bancoaccesso[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bancoaccesso[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/bancoaccesso[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bancoaccesso[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.55.18 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
archived copy in the Wayback Machine
73m.commerz-stornierungen[.]comcorrelateddomain gone2026-03-07 → 2026-03-16
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]commerz-stornierungen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]commerz-stornierungen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]commerz-stornierungen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]commerz-stornierungen[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/commerz-stornierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-stornierungen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/commerz-stornierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-stornierungen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Commerzbank · resolves to 2a00:12d8:700e:0:60ea:bd50:7158:f36 · resolves to 5.230.77.194 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
74apo-bank-seite[.]comcorrelateddns pulled2026-03-13
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-bank-seite[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-bank-seite[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-bank-seite[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-bank-seite[.]com decides registered vs gone · Observed Registered via Global Domain Group LLC (IANA 3956); abuse contact abuse@globaldomaingroup.com
registrar=Global Domain Group LLC iana_id=3956 abuse=abuse@globaldomaingroup.com
GET https://rdap.org/domain/apo-bank-seite[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-seite[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client hold|client transfer prohibited
GET https://rdap.org/domain/apo-bank-seite[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-seite[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.76.233 · in network GHOSTnet GmbH · registered via Global Domain Group LLC
75apo-onlineservice[.]comcorrelateddns pulled2026-03-09
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-onlineservice[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-onlineservice[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-onlineservice[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-onlineservice[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/apo-onlineservice[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-onlineservice[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-onlineservice[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-onlineservice[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.78.48 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
76m.vr-storno[.]comcorrelateddomain gone2026-03-07
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]vr-storno[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]vr-storno[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]vr-storno[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]vr-storno[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/vr-storno[.]com (redirected to https://rdap.verisign.com/com/v1/domain/vr-storno[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/vr-storno[.]com (redirected to https://rdap.verisign.com/com/v1/domain/vr-storno[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.77.194 · name resembles Volksbanken Raiffeisenbanken (VR) · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
77apo-bank-service[.]comcorrelateddns pulled2026-03-05
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-bank-service[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-bank-service[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-bank-service[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-bank-service[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/apo-bank-service[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-service[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-bank-service[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-service[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.77.22 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
78apo-banka[.]comcorrelateddns pulled2026-03-04
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-banka[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-banka[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-banka[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-banka[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/apo-banka[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-banka[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-banka[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-banka[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.55.26 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
79vr-storno[.]comcorrelateddns pulled2026-03-03
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://vr-storno[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://vr-storno[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=vr-storno[.]com&type=A|MX; when both are empty, https://rdap.org/domain/vr-storno[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/vr-storno[.]com (redirected to https://rdap.verisign.com/com/v1/domain/vr-storno[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/vr-storno[.]com (redirected to https://rdap.verisign.com/com/v1/domain/vr-storno[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Volksbanken Raiffeisenbanken (VR) · resolves to 5.230.77.250 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
80commerz-reaktivierungen[.]comcorrelateddns pulled2026-03-02
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://commerz-reaktivierungen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://commerz-reaktivierungen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=commerz-reaktivierungen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/commerz-reaktivierungen[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/commerz-reaktivierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-reaktivierungen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: active
active
GET https://rdap.org/domain/commerz-reaktivierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-reaktivierungen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Commerzbank · resolves to 5.230.77.146 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
81apo-portal-bank[.]comcorrelateddns pulled2026-02-24 → 2026-02-27
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-portal-bank[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-portal-bank[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-portal-bank[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-portal-bank[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/apo-portal-bank[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-portal-bank[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-portal-bank[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-portal-bank[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.77.146 · resolves to 139.162.166.243 · resolves to 172.104.157.4 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp · in network Akamai Technologies, Inc.
82mali-ionos[.]comcorrelateddns pulled2026-02-27
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://mali-ionos[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://mali-ionos[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=mali-ionos[.]com&type=A|MX; when both are empty, https://rdap.org/domain/mali-ionos[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/mali-ionos[.]com (redirected to https://rdap.verisign.com/com/v1/domain/mali-ionos[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/mali-ionos[.]com (redirected to https://rdap.verisign.com/com/v1/domain/mali-ionos[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 5.230.75.115 · name resembles IONOS · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
83apo-bank-portale[.]comcorrelateddns pulled2026-02-20 → 2026-02-23
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-bank-portale[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-bank-portale[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-bank-portale[.]com&type=A|MX; when both are empty, https://rdap.org/domain/apo-bank-portale[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/apo-bank-portale[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-portale[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/apo-bank-portale[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-bank-portale[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 139.162.166.243 · ns at dnspod.com · registered via Hello Internet Corp · in network Akamai Technologies, Inc.
84commerz-portalhilfe[.]comcorrelateddns pulled2026-02-18
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://commerz-portalhilfe[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://commerz-portalhilfe[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=commerz-portalhilfe[.]com&type=A|MX; when both are empty, https://rdap.org/domain/commerz-portalhilfe[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/commerz-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-portalhilfe[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/commerz-portalhilfe[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-portalhilfe[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Commerzbank · resolves to 139.162.171.203 · ns at dnspod.com · registered via Hello Internet Corp · in network Akamai Technologies, Inc.
85bwbank-kundenportal[.]comcorrelateddns pulled2026-02-18
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://bwbank-kundenportal[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://bwbank-kundenportal[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=bwbank-kundenportal[.]com&type=A|MX; when both are empty, https://rdap.org/domain/bwbank-kundenportal[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/bwbank-kundenportal[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bwbank-kundenportal[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/bwbank-kundenportal[.]com (redirected to https://rdap.verisign.com/com/v1/domain/bwbank-kundenportal[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings resolves to 139.162.171.203 · name resembles BW-Bank · ns at dnspod.com · registered via Hello Internet Corp · in network Akamai Technologies, Inc.
86commerz-aktivierungen[.]comcorrelateddns pulled2026-02-17
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://commerz-aktivierungen[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://commerz-aktivierungen[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=commerz-aktivierungen[.]com&type=A|MX; when both are empty, https://rdap.org/domain/commerz-aktivierungen[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/commerz-aktivierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-aktivierungen[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/commerz-aktivierungen[.]com (redirected to https://rdap.verisign.com/com/v1/domain/commerz-aktivierungen[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Commerzbank · resolves to 185.181.8.54 · ns at dnspod.com · registered via Hello Internet Corp · in network Kamatera Inc
87apo-bankportal[.]cccorrelateddns pulled2026-02-14
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apo-bankportal[.]cc/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apo-bankportal[.]cc/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apo-bankportal[.]cc&type=A|MX; when both are empty, https://rdap.org/domain/apo-bankportal[.]cc decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apo-bankportal[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/apo-bankportal[.]cc); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apo-bankportal[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/apo-bankportal[.]cc); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 185.181.8.54 · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED · in network Kamatera Inc
88apobanken[.]cccorrelateddns pulled2026-02-13 → 2026-02-14
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://apobanken[.]cc/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://apobanken[.]cc/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=apobanken[.]cc&type=A|MX; when both are empty, https://rdap.org/domain/apobanken[.]cc decides registered vs gone · Observed Registered via NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765); abuse contact abuse@nicenic.net
registrar=NICENIC INTERNATIONAL GROUP CO., LIMITED iana_id=3765 abuse=abuse@nicenic.net
GET https://rdap.org/domain/apobanken[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/apobanken[.]cc); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited
GET https://rdap.org/domain/apobanken[.]cc (redirected to https://tld-rdap.verisign.com/cc/v1/domain/apobanken[.]cc); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 185.181.8.54 · ns at dnspod.com · registered via NICENIC INTERNATIONAL GROUP CO., LIMITED · in network Kamatera Inc
89coba-sicherheitsaktion[.]comcorrelateddns pulled2026-02-06
No A/MX records; domain still registered
state=dns_removed http=530 a=- mx=0 final=hxxps://coba-sicherheitsaktion[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://coba-sicherheitsaktion[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=coba-sicherheitsaktion[.]com&type=A|MX; when both are empty, https://rdap.org/domain/coba-sicherheitsaktion[.]com decides registered vs gone · Observed Registered via MAT BAO CORPORATION (IANA 1586); abuse contact abuse@matbao.com
registrar=MAT BAO CORPORATION iana_id=1586 abuse=abuse@matbao.com
GET https://rdap.org/domain/coba-sicherheitsaktion[.]com (redirected to https://rdap.verisign.com/com/v1/domain/coba-sicherheitsaktion[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client delete prohibited, client hold, client transfer prohibited, client update prohibited — client hold: the registrar has placed the domain on hold
client delete prohibited|client hold|client transfer prohibited|client update prohibited
GET https://rdap.org/domain/coba-sicherheitsaktion[.]com (redirected to https://rdap.verisign.com/com/v1/domain/coba-sicherheitsaktion[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Commerzbank · resolves to 5.230.57.148 · resolves to 5.230.77.138 · in network GHOSTnet GmbH · ns at dnspod.com · registered via MAT BAO CORPORATION
90m.apo-banken[.]comcorrelateddomain gone2026-02-06
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://m[.]apo-banken[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://m[.]apo-banken[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=m[.]apo-banken[.]com&type=A|MX; when both are empty, https://rdap.org/domain/m[.]apo-banken[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/apo-banken[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-banken[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-banken[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-banken[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.77.138 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
91www.apo-banken[.]comcorrelateddomain gone2026-02-06
Domain not present in the registry (RDAP 404)
state=domain_gone http=530 a=- mx=0 final=hxxps://www[.]apo-banken[.]com/ sha256=62cb344a00a01e92ee1f31b253f3fa365ff05805bb03aa2f4e153c129ca729a7 bytes=16 build_id=- server=cloudflare powered_by=- set_cookie=-
GET hxxps://www[.]apo-banken[.]com/ (redirects followed, UA fraud-investigator-monitor/1.0); A and MX via https://cloudflare-dns.com/dns-query?name=www[.]apo-banken[.]com&type=A|MX; when both are empty, https://rdap.org/domain/www[.]apo-banken[.]com decides registered vs gone · Observed Registered via Hello Internet Corp (IANA 1924); abuse contact abuse@hello.co
registrar=Hello Internet Corp iana_id=1924 abuse=abuse@hello.co
GET https://rdap.org/domain/apo-banken[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-banken[.]com); entities[roles∋registrar]: vcardArray fn, publicIds[type="IANA Registrar ID"].identifier, nested entities[roles∋abuse] vcard email · Observed · sourceRegistry status: client hold — client hold: the registrar has placed the domain on hold
client hold
GET https://rdap.org/domain/apo-banken[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-banken[.]com); status[] (EPP status codes, see https://icann.org/epp) · Observed · sourceStrings name resembles Deutsche Apotheker- und Ärztebank (apoB… · resolves to 5.230.77.138 · in network GHOSTnet GmbH · ns at dnspod.com · registered via Hello Internet Corp
Board checks 4
017 hosts confirmed serving the kit, 84 correlated by search only, 6 confirmed hosts still answering
adversary=7 unknown=84 redirector=4 cleared=0 live_adversary=6
COUNT(*) over leads WHERE kind='host' GROUP BY class; live = monitor state 'live' ·
Observed
· § check 01
0283 of 95 board hosts were observed on GHOSTnet GmbH (AS12586); the rest on AS63949 (4), AS41436 (3), AS49392 (2), AS2635 (1)
AS12586 83 AS63949 4 AS41436 3 AS49392 2 AS2635 1
COUNT(*) over edges WHERE relation='in_asn' GROUP BY dst ASN, for this board's host leads ·
Observed
· § check 02
03Median observed host lifetime 0 days (first to last public sighting, 92 hosts with both dates)
median=0.0 p90=4.0 n=92
last_seen − first_seen per host lead, median over hosts with both dates ·
Observed
· § check 03
0495 hosts on the board; earliest sighting 2026-01-30, most recent 2026-08-26
first_seen min=2026-01-30T22:32:09 · last_seen max=2026-08-26T08:54:32.333Z
MIN(first_seen), MAX(last_seen) over leads WHERE kind='host' for this board ·
Observed
· § check 04
Assessment
Withheld. The verdict stays in the file. Each line above is one check — what was tested, how, and when.
Strings · 482 recorded, by relation
urlscan.io GET /api/v1/search/?q=hash:<sha256>&size=100 for the two kit chunk hashes (023914ebba65, a50f045c14ea); hostname = task.url host…DoH A search.app via https://cloudflare-dns.com/dns-query?name=search.app&type=ADoH A share.google via https://cloudflare-dns.com/dns-query?name=share.google&type=ADoH A aktualisierun-apo[.]app via https://cloudflare-dns.com/dns-query?name=aktualisierun-apo[.]app&type=ADoH A bbvaseguridad[.]com via https://cloudflare-dns.com/dns-query?name=bbvaseguridad[.]com&type=Aand other methods
2a00:12d8:700e:0:a9cb:7a0b:527c:fabe → Team Cymru e.b.a.f.c.7.2.5.b.0.a.7.b.c.9.a.0.0.0.0.e.0.0.7.8.d.2.1.0.0.a.2.origin6.asn.cymru.com TXT…5.231.5.9 → Team Cymru 9.5.231.5.origin.asn.cymru.com TXT via https://cloudflare-dns.com/dns-query?name=9.5.231.5.origin.asn.cymru.com&type…5.231.4.214 → Team Cymru 214.4.231.5.origin.asn.cymru.com TXT via https://cloudflare-dns.com/dns-query?name=214.4.231.5.origin.asn.cymru.co…5.231.3.223 → Team Cymru 223.3.231.5.origin.asn.cymru.com TXT via https://cloudflare-dns.com/dns-query?name=223.3.231.5.origin.asn.cymru.co…5.231.5.207 → Team Cymru 207.5.231.5.origin.asn.cymru.com TXT via https://cloudflare-dns.com/dns-query?name=207.5.231.5.origin.asn.cymru.co…and other methods
GET https://rdap.org/domain/ap-ocdc[.]com (redirected to https://rdap.verisign.com/com/v1/domain/ap-ocdc[.]com); entities[roles∋registrar] …GET https://rdap.org/domain/apo-aktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktualisierung[.]com); enti…GET https://rdap.org/domain/eddor[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/eddor[.]info); entities[roles∋reg…GET https://rdap.org/domain/golinks[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/golinks[.]info); entities[roles…GET https://rdap.org/domain/connectwithyomyg[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/connectwithyomyg[.]inf…and other methods
GET https://rdap.org/domain/ap-ocdc[.]com (redirected to https://rdap.verisign.com/com/v1/domain/ap-ocdc[.]com); nameservers[].ldhName = a.…GET https://rdap.org/domain/apo-aktualisierung[.]com (redirected to https://rdap.verisign.com/com/v1/domain/apo-aktualisierung[.]com); name…GET https://rdap.org/domain/eddor[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/eddor[.]info); nameservers[].ldhN…GET https://rdap.org/domain/golinks[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/golinks[.]info); nameservers[].…GET https://rdap.org/domain/connectwithyomyg[.]info (redirected to https://rdap.identitydigital.services/rdap/domain/connectwithyomyg[.]inf…and other methods
hostname matches /bnb-/ihostname matches /commerz|coba-/ihostname matches /apo/ihostname matches /bwbank/ihostname matches /ionos/iand other methods
captured 20260825T122434Z: response body sha256 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 — byte-identical to the an…captured 20260825T124503Z: HTTP 200 from nginx/1.26.3, X-Powered-By: Next.js, buildId -RsevR6KUB8IDNx2FX59E identical to the anchor host (f…captured 20260825T124056Z: response body sha256 92ca5c85ab7870ffcc5514dc7121240c1cfa6ad4fc034bce01ca6adfc26189f8 — byte-identical to the an…GET hxxps://bbvaseguridad[.]com/: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_* equal kit lead 92ca5c85ab7870ffcc5514dc…GET hxxps://bnb-wiederherstellung[.]com/: Server=nginx/1.26.3 + X-Powered-By=Next.js + Set-Cookie visited_* equal kit lead 92ca5c85ab7870ff…and other methods
urlscan.io scan 01a00094-7ad7-7782-83eb-67efb7329414: task.domain eddor[.]info landed on page.domain apo-aktualisierung[.]comurlscan.io scan 019fcdd7-6393-7675-be13-7f321a95bab2: task.domain connectwithyomyg[.]info landed on page.domain apo-nunaktualisieren[.]comurlscan.io scan 019ff537-34b4-7362-8e89-22beacd4542c: task.domain mitom[.]club landed on page.domain apo-aktualisierung[.]comGET hxxps://o2online-portal[.]com/ followed redirects to hxxps://href[.]li/?https://wikipedia.de