kleiderkraenzchen[.]de

Analysis of the domain kleiderkraenzchen.de indicates it was established as a high-risk phishing infrastructure targeting retail consumers. The domain was registered on February 21, 2026, through 1blu.de and currently resolves to IP address 87.238.192.51, hosted on AS42730 (EVANZO e-commerce GmbH) in Germany. Nameservers ns1.evanzo.com and ns12.evanzo.de are configured, consistent with hosting provider infrastructure. The SSL certificate, issued by Sectigo Limited under the Sectigo RSA Domain Validation Secure Server CA, returned a valid HTTP 200 status during recent scans, though the page displayed only a 'Coming Soon' placeholder, suggesting either pre-deployment staging or an attempt to evade detection.

Google Safe Browsing has flagged the domain for social engineering, and it appears on one security blocklist. AlienVault OTX records the domain in a single threat intelligence pulse, though specific campaign details remain limited. Fifteen of 93 security vendors on VirusTotal have detected the domain as malicious, providing corroborating evidence of its suspicious nature. The domain has since been taken offline, likely following detection and mitigation efforts by security providers such as PhishDestroy.

While the exact target or brand impersonation is not confirmed due to the absence of page content analysis, the domain name suggests an intent to mimic a retail or clothing-related service. Defenders should treat kleiderkraenzchen.de as a confirmed phishing threat and block access at the network level. Monitoring for related domains registered through the same registrar or hosted on the same ASN may help identify additional malicious infrastructure. No further page content or campaign-specific indicators are currently available.