bommel-und-mehr[.]de

Analysis of bommel-und-mehr.de shows an active phishing infrastructure with a high risk rating. The domain resolves to IP 82.100.220.167, hosted in Germany under AS25394 MK Netzdienste Verwaltungs GmbH. It serves HTTP 200 responses and presents a Let’s Encrypt R13 certificate, indicating a valid TLS handshake but offering no content; the page title explicitly states “Für diese Domain wurden keine Inhalte hinterlegt.” The web server reports Apache HTTP Server with Tailwind CSS and Unpkg assets, suggesting a generic template rather than a targeted brand clone. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100) and the domain appears on two dedicated phishing blocklists (PhishDestroy, PhishingDB). VirusTotal records show 14 of 95 security vendors flag the host, and AlienVault OTX lists the domain in 16 threat‑intel pulses, reinforcing its malicious classification. DNS configuration uses goneo.de name servers (ns1.goneo.de, ns2.goneo.de) and MX records mx01.goneo.de and mx02.goneo.de, consistent with the registrar’s infrastructure. Defenders should immediately block the domain and its resolving IP, incorporate the associated name servers and MX hosts into network‑level deny lists, and monitor outbound traffic for any connections to the listed IP or related AS. Continuous threat‑intel feeds should be consulted for updates, as the domain’s presence on multiple feeds indicates ongoing abuse.