kkz-insolvenzrecht[.]info

This domain, kkz-insolvenzrecht.info, was registered on 23 February 2026 through NiceNIC International Group Co., Limited. The registration is recent, and the domain has already appeared on a security blocklist, specifically PhishDestroy, indicating that it is being used for malicious activity. Technical analysis shows that the domain resolves to IP address 104.21.8.45, which belongs to Cloudflare, Inc. (AS13335) and is physically located in the United States. The use of Cloudflare’s network together with Vercel‑hosted assets suggests the attacker is leveraging reputable cloud services to mask the true location of the payload. The site presents a TLS certificate issued by Let’s Encrypt, which is valid and provides encryption, but does not confer any trustworthiness.

HTTP requests receive a 307 temporary redirect response, a pattern often employed to forward victims to a secondary phishing or cryptocurrency‑draining page. The page title returned by the server is “KKZ Insolvenzrecht | Insolvenzrecht München,” implying a fraudulent impersonation of a German insolvency law practice, yet no further content has been examined. VirusTotal analysis reports that three out of ninety‑three scanning engines have flagged the domain as malicious, reinforcing the suspicion of abuse. Additional reputation data is bleak: Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, and the domain’s overall risk rating is classified as high.

The technology stack includes HSTS and HTTP/3, which are typical of modern web services but do not mitigate the malicious intent. The available intelligence points to a crypto‑related phishing campaign, consistent with the listed scam type “Crypto Scam.” However, the exact payload, payment mechanism, or victim interaction flow remains unknown because the site’s content has not been publicly dissected. Defenders should therefore treat the domain as hostile: block DNS resolution and any outbound connections to 104.21.8.