engelhardtschmuck[.]de

On 23 July 2026 analysts observed the domain engelhardtschmuck.de associated with a generic phishing campaign. The site returned a simple “COMING SOON” title and is currently taken offline. VirusTotal records indicate that 13 out of 95 scanning engines flagged the domain, suggesting malicious activity. AlienVault OTX references the domain in 18 separate threat pulses, reinforcing its reputation as a recurring phishing indicator. The domain is hosted on nameservers ns81.domaincontrol.com and ns82.domaincontrol.com, both typical of GoDaddy’s shared DNS service.

Registration details show the domain was provisioned through the DE‑GD‑EMEA‑DCN registrar and is advertised under ASN 21499, which maps to Host Europe GmbH in France. DNS resolution points to IP address 92.205.51.165; the same IP is listed on at least one public security blocklist and has been flagged by the PhishDestroy blocklist. The host presents an SSL certificate issued to “ispgateway” with the common name webslave.ispgateway.de, a certificate often observed on abused hosting platforms. Gridinsoft assigned a trust score of 0 / 100, the lowest possible rating, indicating extreme suspicion.

The combination of multiple vendor detections, repeated OTX mentions, low trust scoring, and blocklist presence characterises the domain as a confirmed phishing infrastructure. Uncertainty remains regarding the specific payload or credential‑harvesting page, as the only visible content is the placeholder title. Defenders should continue to block the domain and its associated IP at perimeter defenses, update URL filtering lists, and monitor for any resurgence of the site. Incident response teams are advised to correlate internal logs for connections to 92.205.51.165 and to watch for similar “ispgateway” certificate use in future campaigns.