medical-kolbe[.]de

Analysis of the domain medical-kolbe.de indicates active credential phishing activity with a high-risk classification. The domain was registered on April 15, 2026, and resolves to IP address 92.205.170.212, hosted by Host Europe GmbH in Germany. Infrastructure analysis reveals the use of WordPress, MySQL, PHP, Yoast SEO, Apache HTTP Server, jQuery Migrate, and jQuery, suggesting a standard but potentially vulnerable web stack commonly exploited for phishing. The page title, 'Home - Physio Kolbe Medicaltraining,' implies a focus on medical or physiotherapy services, which may be used to deceive users in the healthcare sector. The domain is flagged by six of ninety-four security vendors on VirusTotal, and it appears on one security blocklist. A Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100 further corroborate its malicious classification. The domain is actively blocked by PhishDestroy, a phishing-specific detection system, and is categorized as a credential phishing threat. SSL certification is provided by Let's Encrypt (R12), a common but not inherently trustworthy issuer in phishing campaigns. Nameservers ns71.domaincontrol.com and ns72.domaincontrol.com are associated with the domain registrar, which is consistent with legitimate and malicious domains alike. The HTTP status code 200 confirms the site is currently accessible, though this does not validate its legitimacy. Defenders should treat this domain as hostile. Blocking the domain and its resolving IP (92.205.170.212) at the perimeter is recommended. Further investigation into associated email addresses, WHOIS details, and hosting infrastructure may reveal additional indicators of compromise. The exact content of the phishing page remains unanalyzed, but the combination of low trust scores, vendor detections, and phishing-specific blocking justifies immediate containment actions.