The sponsoring registrar is GNAME.COM PTE. LTD. (Singapore), IANA registrar ID 1923, with registrant data not published

Registrar: GNAME.COM PTE. LTD.; IANA ID 1923; abuse contact vCard "Lili Zhang", legal@gname.com, tel:+65.65189986; registrar RDAP https://rdap.gname.com/domain/ap-ocdc.app; no registrant/admin/tech entity published (RDRS referral only)

ap-ocdc.app resolves to 5.231.5.249, a VPS-hosting address of GHOSTnet GmbH in Germany

A record 5.231.5.249 (TTL 600); RIPE inetnum 5.231.5.0 - 5.231.5.255, netname DE-GHOSTNET-FRA-GN-HOSTING-VPS, descr "GHOSTnet Network used for VPS Hosting Services", country DE, route 5.231.5.0/24, mnt-by GHOSTNET-MNT, abuse-mailbox abuse@ghostnet.de

The only TLS certificate for the host is a 90-day Let's Encrypt certificate whose validity begins 2026-08-21, minutes after the domain was created

subject CN=ap-ocdc.app; issuer C=US, O=Let's Encrypt, CN=YE2; serial 0678818B9970CE6F9FFA0DA8B44BB08E6CDA; notBefore Aug 21 08:08:49 2026 GMT; notAfter Nov 19 08:08:48 2026 GMT; single SAN DNS:ap-ocdc.app (no www SAN despite www resolving). Let's Encrypt sets notBefore one hour before actual issuance, so issuance was approx 09:08 UTC on 2026-08-21, about 11 minutes after the 08:57:24 UTC domain creation.

The deployed kit's static assets carry a Last-Modified timestamp 19 seconds before the domain itself was created, indicating automated provisioning rather than hand-built one-off site

Asset _buildManifest.js Last-Modified: Fri, 21 Aug 2026 08:57:05 GMT. RDAP domain registration: 2026-08-21T08:57:24.780Z. Delta: kit deployment artefact is 19 s earlier than domain creation; TLS issuance followed at approx 09:08 UTC. Full observed provisioning window from deploy to working HTTPS phishing host: about 11 minutes.

Certificate Transparency shows exactly one certificate has ever been issued for ap-ocdc.app or any subdomain, dated 2026-08-21, confirming the domain had no prior life

Single issuance record id 16654217416; cert_sha256 bb7888493817ccf74657c4610f375d0b3b4b59261e10ea9cf427b904f5d1db62; dns_names ["ap-ocdc.app"] only; issuer Let's Encrypt CN=YE2; not_before 2026-08-21T08:08:49Z; not_after 2026-11-19T08:08:48Z; revoked false. No sibling hostnames appear in the issuance, and no other subdomain has ever been certified.

The letter's footer reproduces apoBank's genuine imprint details exactly but lists only three of the five current Vorstand members, omitting Thomas Runge and Sylvia Wilhelm

apoBank official imprint (retrieved 2026-08-24) states: Deutsche Apotheker- und Ärztebank eG, Richard-Oskar-Mattern-Straße 6, 40547 Düsseldorf; BLZ 300 606 01; BIC DAAEDEDDXXX; Vorsitzender des Aufsichtsrats Dr. med. dent. Karl-Georg Pochhammer; Vorstand: Matthias Schellenberg (Vorstandsvorsitzender), Heiko Drews, Thomas Runge, Dr. Christian Wiermann, Sylvia Wilhelm; Eintragung Amtsgericht Düsseldorf GnR 410. The letter matches on address, BLZ, BIC and the Aufsichtsrat chairman, but its Vorstand block reads only "Matthias Schellenberg, Heiko Drews, Dr. Christian Wiermann" — two sitting board members are missing and Schellenberg's Vorstandsvorsitzender title is dropped. The footer is therefore copied from genuine apoBank material that is no longer current.

German medical self-governance bodies have publicly warned about the same postal apoBank QR-code fraud, describing it as a large-scale campaign targeting healthcare professionals

Kassenärztliche Bundesvereinigung (KBV) practice-news warning of 25.06.2025 and KV Nordrhein warning of 26.06.2025 both describe criminals sending letters in apoBank's name whose QR code leads to a counterfeit site that captures online-banking credentials on "Anmelden", and both direct victims to apoBank's fraud hotline 0211 59794-7777. KVWL and HÄVN published parallel warnings. This establishes the postal-QR method against apoBank customers as a recurring campaign predating the case letter by more than a year, not a novel one-off.

The signatory "Wolfgang Brandt, IT-Organisator" is a fictitious persona reused across this campaign; the role does not exist at apoBank

KV Rheinland-Pfalz states the fraudulent letters bear the forged signature of "IT-Organisator Wolfgang Brandt". MEDI Südwest e.V. lists the same name as a red flag and states explicitly that this function does not exist at apoBank ("diese Funktion gibt es bei der apoBank nicht"). Pharmazeutische Zeitung reports counterfeit apoBank letters to pharmacies purportedly signed by "IT-Organisator Wolfgang Brandt". The identical name and invented job title in the case letter therefore ties it to the same campaign; no such person or role is evidenced at apoBank. apoBank's Vorstand and published organisational information contain no "IT-Organisator" function.

The letter's central premise — a "gesetzlich vorgeschriebene" (legally mandated) verification of digital banking access via QR code — is contradicted by the bank itself

The letter asserts that without "dieser gesetzlich vorgeschriebenen Verifizierung" the recipient's apoBank-App, Online-Banking and apoTAN-App access will be restricted, payment orders will cease and incoming credits will be returned to sender. apoBank's own security page states the bank does not ask customers by letter to "verify" digital access via QR code, and that it never requests access credentials or TANs outside its official website and app. No provision of German banking law requires a customer to re-verify online-banking access by scanning a QR code in a letter and entering a printed reference code on a third-party website. The threat that incoming credits would be "retourniert" has no basis in SEPA credit-transfer handling for an otherwise valid account.

As of 2026-08-24 the domain has no public scan or report history, indicating it is still live and not yet blocklisted

urlscan.io search page.domain:ap-ocdc.app returned total 0; search page.ip:"5.231.5.249" returned total 0. The host was serving normally during this investigation (HTTP 200 on static assets at 14:29-14:36 UTC on 2026-08-24), and plain HTTP on port 80 issues a 301 to https://ap-ocdc.app/. Combined with the 2026-08-21 registration this means the domain is three days old, active, and absent from at least one major public scan corpus.

The domain has exactly one certificate in certificate transparency, a Let's Encrypt leaf whose validity begins 2026-08-21 08:08:49 UTC

Certspotter returns 1 issuance for ap-ocdc.app (include_subdomains=true): issuer "C=US, O=Let's Encrypt, CN=YE2", dns_names ["ap-ocdc.app"], notBefore 2026-08-21T08:08:49Z, notAfter 2026-11-19T08:08:48Z, not revoked, cert_sha256 bb7888493817ccf74657c4610f375d0b3b4b59261e10ea9cf427b904f5d1db62. The live TLS handshake on 5.231.5.249:443 with SNI ap-ocdc.app presents the same leaf (serial 0678818B9970CE6F9FFA0DA8B44BB08E6CDA, SAN: ap-ocdc.app only). Let's Encrypt backdates notBefore by one hour, so actual issuance was ≈09:08Z, ≈11 minutes after the domain was created; there is no CT record of the name before 2026-08-21.

ap-ocdc.app resolves to a single German VPS at GHOSTnet GmbH (AS12586) on both IPv4 and IPv6, with DNSPod (Tencent) nameservers and no mail configuration

A 5.231.5.249; AAAA 2a00:12d8:700e:0:fe4b:5d91:2db6:4725; www.ap-ocdc.app → same A. NS a/b/c.dnspod.com (SOA a.dnspod.com, RNAME domainadmin.dnspod.com, serial 1787303963). No MX, no TXT (therefore no SPF), no CAA. RIPE: 5.231.5.0-5.231.5.255 netname DE-GHOSTNET-FRA-GN-HOSTING-VPS, descr "GHOSTnet Network used for VPS Hosting Services", country DE, route 5.231.5.0/24 origin AS12586, abuse-mailbox abuse@ghostnet.de. IPv6 falls in 2a00:12d8::/29, org ORG-GG3-RIPE "GHOSTnet GmbH", same abuse-c GN-RIPE.

The panel's own API surface shows live victim-session relaying, Telegram alerting, captcha gating, per-domain statistics and a "fastflux" proxy/IPv6 rotation subsystem tied to an upstream service at bestsuite.cc

API routes referenced by the client bundles include /api/sessions, /api/sessions/changeSite, /api/logs/create, /api/logs/upload, /api/logs/upload-code, /api/logs/fetch-bank-logo?url=, /api/domains/add, /api/domains/install, /api/domains/proxy, /api/domains/status, /api/domains/verify-reference-code, /api/domains/verify-captcha-v2, /api/domains/verify-captcha-v3, /api/bans, /api/custom-templates, /api/alerter/domains, /api/panel-logs, and 21 /api/fastflux/* routes (activate-proxy, activate-dedicated-proxy, assign-proxy, switch-proxy, set-proxy-ipv6, apply-all-ipv6, set-global-ip, bulk-buy, buy-status, install-cert, install-proxy, reinstall-all, verify-dns, add/remove-external-domain, bestsuite-domains, list-*). UI strings include "Aktuelle Live Sessions", "LIVE", "Bot Token wurde erfolgreich geändert.", "Chat ID speichern", "Meine Abonnements", "Passwort für /stats/domain Zugang...", "BESTSUITE User", and a help text reading "Du kannst auch Domains eingeben, die nicht im Panel registriert sind (z.B. bestsuite.cc)." The panel UI language is German throughout. An unauthenticated GET of /api/domains returns HTTP 401 with a 43-byte JSON body; /backend and /auth/login return HTTP 200 shells for the same build id. No credentials were submitted and no authenticated route was accessed.

The apoBank logo served by the phishing host is a byte-identical copy of a file published on apoBank's own website

https://ap-ocdc.app/apobank.svg (HTTP 200, image/svg+xml, 1933 bytes) has sha256 87fc265414c0b17c24bd9075309ceed6792a1eb34463367420cdf33f4524de29, identical to https://www.apobank.de/.resources/apocore/webresources/assets/favicon/safari-pinned-tab.svg. The file's embedded metadata reads "Created by potrace 1.1", inherited from apoBank's original. (apoBank's main logo file apobank_logo_zusatz.svg hashes differently, fed2a2217d0df22b335b49b48b374408d6c583a92e92a8066f4934b5a26c8b24, so the match is specific to the pinned-tab asset.)

apoBank published a warning about this exact postal QR-code letter on 14.08.2026, one week before the letter is dated and before the domain was registered

apoBank's security page carries a dated entry "14.08.2026 | Betrugsmasche: Gefälschte Briefe mit QR-Code zur „Verifizierung“" stating that postal phishing letters styled like official apoBank correspondence are in circulation, that they claim a required "Verifizierung" is incomplete, that they threaten deactivation of apoBank-App, Online-Banking and apoTAN if the enclosed QR code is not scanned, and that the QR code leads to a fake website harvesting online-banking credentials. Recognition markers it lists include a QR code with the instruction "Hier bitte scannen" and the claim of an outstanding "Verifizierung" — both present verbatim in the letter under investigation. The same page also carries an 11.08.2026 entry about fake apoBank online-banking links appearing in search-engine results and a 20.08.2026 entry about follow-up phone calls; 23 dated fraud entries in total.

The signatory "Wolfgang Brandt, IT-Organisator" is a recurring fake identity in this campaign, and German professional bodies state the role does not exist at apoBank

Warnings published by German healthcare-profession bodies describe letters bearing the same forged signature: KV Rheinland-Pfalz ("Warnung vor Phishing: gefälschte Apobank-Schreiben an Praxen im Umlauf", 25.06.2025) refers to the forged signature of "IT-Organisator Wolfgang Brandt"; MEDI Südwest e.V. lists as a warning sign an unusual sender, "IT-Organisator Wolfgang Brandt", adding that this function does not exist at apoBank; Pharmazeutische Zeitung (13.06.2025) describes the same threat wording about apoBank-App, Online-Banking and the apoTAN application being deactivated and payment orders and credits no longer being processed. Further warnings about the same postal QR-code scheme come from KVWL (26.06.2025), Landeszahnärztekammer Thüringen (26.06.2026) and Zahnärztekammer Schleswig-Holstein. This establishes that the same template, signatory and threat wording have been in postal circulation since at least June 2025 — over a year before the 21.08.2026 letter in this case. Note: apoBank does not publish a staff directory, so the non-existence of the person was not independently verified against a primary register; the statement rests on the professional bodies' publications.

The letter claims repeated prior reminders and a statutory verification duty, yet the domain its QR code points to was created at 08:57 UTC on the letter's own date

The letter is dated "Düsseldorf, den 21.08.2026" and opens "trotz mehrfacher Erinnerungen haben wir von Ihnen bislang keine abgeschlossene Verifizierung ... erhalten", asserting a "gesetzlich vorgeschriebene Verifizierung" without citing any legal basis, and threatening that credits will be returned to the sender ("Gutschriften werden an den Absender retourniert"). ap-ocdc.app was created 2026-08-21T08:57:24Z and its only TLS certificate has notBefore 2026-08-21T08:08:49Z; the domain therefore did not exist during any of the claimed earlier reminders. apoBank's published guidance and the Zahnärztekammer Schleswig-Holstein warning both state the bank does not ask customers by letter to verify digital access via QR code.

85 of the 91 correlated campaign hostnames were observed on GHOSTnet GmbH (AS12586) address space; the remaining six sat briefly on CloudWebManage and Linode in February 2026

Of 91 hostnames correlated by identical kit-chunk hashes, 85 had at least one urlscan observation with page.asnname containing "GHOSTNET" (GHOSTnet GmbH, DE). The six without are apobanken.cc, apo-bankportal.cc and commerz-aktivierungen.com (CloudWebManage-EU / 185.181.8.54) and apo-bank-portale.com, bwbank-kundenportal.com and commerz-portalhilfe.com (Akamai-Linode / 139.162.x), all observed 2026-02-13 to 2026-02-23 — a short excursion before the campaign settled back onto GHOSTnet. Observed GHOSTnet address ranges: 5.230.26/55/57/69/70/73/75/76/77/78/95/122/194/250.x, 5.231.2/3/4/5.x and 2a00:12d8:700e::/48.