klamotte-vivaldihaus[.]de

This domain, klamotte-vivaldihaus.de, is currently active and returns HTTP status code 200. DNS resolution points to IP 217.160.0.22, which is assigned to the German AS8560 network operated by IONOS SE. The web server identifies as Apache HTTP Server and presents an SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36. The domain was created on 28 December 2023 and uses four nameservers (ns1067.ui-dns.biz, ns1067.ui-dns.com, ns1067.ui-dns.de, ns1067.ui-dns.org). Reputation metrics show a Gridinsoft trust score of 0/100 and 18 of 95 security vendors on VirusTotal flag the host. It appears on two public blocklists, PhishDestroy and PhishingDB, and is referenced in 17 AlienVault OTX pulses. The page title returned is “Home - Vivaldi-Haus”, suggesting an attempt to impersonate the Vivaldi‑Haus brand, although the page content has not been examined. MX records point to IONOS mail exchangers (mx01.ionos.de and mx00.ionos). The available intelligence confirms malicious infrastructure but does not disclose the specific phishing payload or credential‑harvesting technique. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the domain and its nameservers, and add the host to internal threat‑intel feeds. Continued observation is advised to detect any changes in content or additional infrastructure.