habibicards[.]de

On 25 July 2026 the domain habibicards.de was observed actively serving content that impersonates American Express. The site resolves to the Cloudflare IP 23.227.38.73, which is registered to AS13335 in Canada. The TLS certificate is issued by Let’s Encrypt (E8) and the connection negotiates HSTS and HTTP/3, indicating a modern web stack. An HTTP 302 redirect is returned for the initial request, and the underlying page title is “Pokémon kaufen bei Habicards – TCG-Shop für One Piece & mehr”, suggesting the domain is being used to host a Shopify‑based e‑commerce front‑end unrelated to the targeted brand. Detected technologies include Shopify, Bootstrap, Trustpilot, Klaviyo, and Cloudflare, confirming that the infrastructure is typical of legitimate storefronts that have been repurposed for malicious activity.

Threat intelligence sources flag the domain as high‑risk. AlienVault OTX lists the domain in one pulse, PhishDestroy has blocked it, and it appears on a single external blocklist. VirusTotal analysis shows three of ninety‑three scanners flag the domain as malicious. The registrar’s nameservers are ns‑cloud‑d1.googledomains.com, ns‑cloud‑d2.googledomains.com, and ns‑cloud‑d3.googledomains.com, all pointing to Google Domains infrastructure.

Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. While the exact phishing kit or credential‑capture page has not been publicly released, the combination of brand impersonation, redirection behavior, and low trust scores provides sufficient evidence for defensive action. Organizations should add habibicards.de and its resolving IP 23.227.38.73 to outbound and inbound filtering rules, monitor DNS queries for the domain, and incorporate the indicator into threat‑intel feeds. Continuous re‑evaluation is advised in case the infrastructure changes or additional detections emerge.