kuemmel-banditos[.]de

The domain kuemmel-banditos.de is currently listed on a security blocklist and is actively blocked by PhishDestroy, indicating a high‑risk phishing operation. Registration occurred on 28 February 2026 through the IONOS registrar, and the domain resolves to the IPv4 address 85.215.75.146, which belongs to AS8560 (IONOS SE) in Germany. DNS configuration shows four SchlundTech name servers (nsa0.schlundtech.de, nsb0.schlundtech.de, nsc0.schlundtech.de, nsd0.schlundtech.de) and an MX record pointing to mail.kuemmel-banditos.de with priority 10. The web server presents a TLS certificate issued by Let’s Encrypt (R13) and runs Nginx, but HTTP requests return a 200 status with the page title “503 Service Unavailable”, suggesting the site is either temporarily disabled or deliberately serving a placeholder page. VirusTotal scans have flagged the domain in 5 of 93 engines, reinforcing the malicious assessment. While no payload or page content has been captured, the combination of blocklist presence, active sink‑blocking, malicious detection ratio, and hosted infrastructure strongly supports a phishing classification. Defenders should deny outbound connections to 85.215.75.146, add the domain and its MX host to deny‑lists, and monitor for any future changes in the HTTP response that could indicate re‑activation of the phishing campaign.