espressonisten[.]de

The domain espressonisten.de is currently active and has been classified as a high‑risk generic phishing site. It was registered on 21 February 2026 and resolves to the IPv4 address 167.71.45.8, which belongs to AS14061, a DigitalOcean hosting network located in Germany. Authoritative name servers are ns5.kasserver.com and ns6.kasserver.com, indicating use of a typical German reseller DNS service. Passive reconnaissance shows the web server returns an HTTP 308 permanent redirect and serves content over TLS with a valid certificate. The site runs a WordPress stack built on PHP, MySQL, Nginx and includes common front‑end libraries such as jQuery, jQuery Migrate and FlexSlider. Reputation services flag the domain as malicious: six of ninety‑five VirusTotal scanners have flagged it, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on two public blocklists. AlienVault OTX records link the domain to six distinct threat‑intel pulses. The only publicly visible indicator of the page’s purpose is the title “„Kaffee ist Kunst – und die ist erlernbar!“ – die espressonisten”, which does not reference a specific brand or credential‑collection page. No further content analysis is available, so the exact phishing lure (e.g., credential harvesting, payment fraud) remains uncertain. The lack of additional artefacts prevents precise attribution of a phishing kit or malware payload. Given the high risk rating, the confirmed hosting, and the multiple detections, defenders should block DNS resolution and HTTP/S traffic to espressonisten.de at perimeter devices. Continuous monitoring of the IP address and associated name servers is advised to detect any pivot or redeployment. Incident response teams should treat any credential or payment data submitted to this domain as compromised and advise affected users to reset credentials immediately.