The attached 23-page "catalogue" PDF was produced by printing an AI-generated design artifact hosted on claudeusercontent.com to PDF in headless Chrome, then post-processed with Ghostscript.

PDF Title = "c7b9dc04-d861-4fc0-a535-46cf37f65af9.claudeusercontent.com/v1/design/projects/c7b9dc04-d861-4fc0-a535-46cf37f65af9/serve/Bestandsliste Exposé - E-Mail kompakt (v1).html?t=...&direct=1"; Creator = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/150.0.0.0"; Producer = "GPL Ghostscript 10.07.1"; CreationDate = 2026-07-31 14:37:11 UTC (2 days before the email was sent)

The domain kanzlei-drechsler.de was last changed at DENIC on 2026-07-29, four days before the unsolicited email was sent on 2026-08-02.

Domain: kanzlei-drechsler.de; Status: connect; Changed: 2026-07-29T13:22:20+02:00; Nserver: stevie.ns.cloudflare.com, vasilii.ns.cloudflare.com

Incoming mail for the claimed Bielefeld law firm is handled by the Russian provider Mail.ru, and the domain carries a Mail.ru business-verification token.

MX: 10 emx.mail.ru; TXT: "v=spf1 redirect=_spf.mail.ru"; TXT: "mailru-domain: byAocigvnd2x6AFI"; DMARC: "v=DMARC1; p=quarantine"

None of the three further lawyers named on the firm's team page are admitted attorneys at the claimed location; two of the three names do not appear in the German bar register at all.

"Jonas Hartmann" → 0 hits nationwide (control "Thomas Hartmann" → 5 hits). "Miriam Scholz" → 0 hits nationwide. "Katharina Weber" → 5 hits nationwide (Berlin, München, Duisburg, Köln, Warendorf), none in Bielefeld; "Weber"+Bielefeld → 0 hits.

The VAT identification number given in the website Impressum, DE134380440, is not a valid VAT number according to the EU Commission's VIES service.

VIES response for member state DE, number 134380440: {"isValid": false, "userError": "INVALID", "requestDate": "2026-08-03T20:29:27Z"}

The first TLS certificate ever issued for kanzlei-drechsler.de dates from 2026-07-29, the same day as the DENIC record change and four days before the mailing; no certificate exists for the domain before that date.

Earliest crt.sh entries: Let's Encrypt YE1, not_before 2026-07-29T10:29:32 (*.kanzlei-drechsler.de + kanzlei-drechsler.de); Google Trust Services WE1 at 2026-07-29T10:36:07; Let's Encrypt YE2 at 2026-07-29T12:42:37. No earlier entries in the CT logs.

The website claims the firm was founded in 2010, has "over 15 years" of practice and 650+ mandates, while its own infrastructure is four days old and its HTML was last modified two days before the mailing.

JSON-LD "foundingDate": "2010"; page text "Seit über 15 Jahren", "Mehr als 650 Mandate", stats block "2010 gegründet in Bielefeld / 15+ Jahre Erfahrung / 650+ betreute Mandate". HTTP Last-Modified of https://kanzlei-drechsler.de/willkommen/: Fri, 31 Jul 2026 16:36:40 GMT.

Behind the polished one-page law-firm site sits an untouched default WordPress installation whose site title is literally "platzhalter" (placeholder) and which still serves the WordPress sample page.

Any unknown path (e.g. https://kanzlei-drechsler.de/robots.txt) returns HTTP 200 with a default Twenty Twenty-Five theme page: <title>platzhalter</title>, site title link "platzhalter", menu item "Beispiel-Seite" (?page_id=2), heading "Blog", meta generator "WordPress 7.0.2". The law-firm content is a single page at /willkommen/, to which / redirects.

A law firm is mass-mailing a 235-position, 27-category merchandise catalogue of mostly brand-new goods and asking for orders by reply e-mail with a minimum order value — an activity that is not lawyer's work and that German professional law bars lawyers from carrying on.

PDF cover: "VERKAUFSEXPOSÉ … Im Rahmen der Verwertung von Insolvenz- und Betriebsauflösungsvermögen veräußern wir die nachstehend aufgeführten Maschinen, Fahrzeuge, Geräte und Betriebsausstattungen im Auftrag und mit Vollmacht der von uns vertretenen Mandanten", "27 WARENGRUPPEN · 235 POSITIONEN", ranging from forklifts to coffee machines, gas grills, MacBooks and toilet paper pallets. E-mail body: "Antworten Sie auf diese E-Mail mit den gewünschten Positionen … Mindestbestellwert 1.500 € … Frei Haus ab 2.500 €". Realising insolvency assets is the insolvency administrator's function (InsO), and § 7 Nr. 8 / § 14 Abs. 2 Nr. 8 BRAO make commercial trading incompatible with admission as a Rechtsanwalt.

A second German "Insolvenzrecht" law-firm site, kortner-partner.de, shows the same construction pattern — content served from the unusual /willkommen/ WordPress path, Cloudflare nameservers, wildcard certificates issued the same day the DENIC record changed — and the lawyer it names is likewise absent from the bar register.

kortner-partner.de: DENIC Changed 2026-05-18T14:30:30+02:00, NS plato/veronica.ns.cloudflare.com; first certificates 2026-05-18T11:38:36 (Let's Encrypt E8, *.kortner-partner.de) and 2026-05-18T12:01:09 (Google Trust Services WE1, wildcard) — the same two-CA wildcard pattern as kanzlei-drechsler.de on 2026-07-29. Indexed content: "Kanzlei Kortner & Partner Rechtsanwälte PartG mbB, Rheinstraße 44, 55116 Mainz, Registereintrag: PR 20260, Vertretungsberechtigung Niko Kortner (geschäftsführender Partner), Clemens Anselm, Telefon +49 6131 4932971", served at https://kortner-partner.de/willkommen/. BRAK search last_name=Kortner → 0 hits nationwide (control last_name=Schmidt, city=Mainz → 8 hits). The domain no longer resolves (SERVFAIL/NXDOMAIN at time of check), i.e. the zone is gone.

The WordPress instance was installed on 2026-07-29 at 15:27, hours after the domain was activated, and its single user is the default "admin" account whose registered e-mail address is provably info@kanzlei-drechsler.de — the same address the mailing asks recipients to reply to.

REST /wp/v2/pages lists exactly one page: id 2, slug "beispiel-seite", date 2026-07-29T15:27:33, modified 2026-07-29T15:27:33. REST /wp/v2/users lists exactly one user: id 1, name "admin", with Gravatar hash 39c70080e0e8ecc3e2344374a7936bc496dd4304b02e6cdb535566d9749a5c06, which equals SHA-256("info@kanzlei-drechsler.de"). The law-firm page itself is not a WordPress page; it is served under /willkommen/ with an "x-redirect-by: redirection" 301 from the root.