Emails from “Attorney Kerk Behrens” and the law firm rechtmuenster.de are a scam. I got one of these emails and picked a fight with the sender. Five days later my website was down, and he threatened to make me out to be a sex offender online.
The scammers stole the name Kerk Behrens from a real lawyer who has nothing to do with any of this. Here I'll tell you how I caught on to the scam, what the scammer gave away about himself along the way, and why he lost it in the end. At the very bottom, you'll find what you can do if an email like this lands in your inbox.
First off: not a word of it is true
The scammer has announced a website about me. It's supposed to claim that I message underage girls on Instagram and Snapchat and ask them for revealing pictures. He wants to submit it to Google and send it to the people who support me.
That is completely made up. I do not message underage girls. Not on Instagram, not on Snapchat, not anywhere. The photo in his preview is more than 15 years old and was stolen from Wikipedia. The police and the State Criminal Police Office have everything.
If you come across the site or an email about it: send me the link through my contact page. I'll pass it on to the investigators.
A Volvo for 31,100 euros
The email arrived on a Thursday evening at the end of October. Sender: “Attorney Kerk Behrens”. In the subject line: an e-mountain bike for 1,900 euros and the note “Verwertung läuft” (liquidation in progress).
The tone was polite and matter-of-fact. A company had stopped production, he wrote, and he was clearing out its stock. Attached was a catalog with 110 items, including e-mountain bikes and a Volvo XC60 for 31,100 euros. The prices were fixed, “not open to haggling”. And if you hesitate, you walk away empty-handed: “what's sold is gone”.
One sentence gave me pause: “I got your details from Databyte's company database.” I hadn't asked for anything.
The real Kerk Behrens is warning people himself
I checked. Kerk Behrens really exists, and he is a lawyer. He has nothing to do with the email. On LinkedIn he writes: “Neither the website nor the emails come from me.” He has filed a criminal complaint himself. (His post on LinkedIn)
Databyte also warns about exactly these emails on its own website. Supposed insolvency goods are being offered in the name of law firms, and the senders claim the addresses came from Databyte. The company's answer is short: “This statement is false.” (Databyte's notice)
At first glance, the website rechtmuenster.de looks like a law firm. At second glance, it doesn't. The sender domain jb-arbeitsrecht.de was registered two weeks before the email and redirects to rechtmuenster.de. The postal code is wrong: Overbergstraße in Münster is in 48145, the firm gives 48151. And the privacy policy still contains a placeholder from the template: “[Insert name and address of the hosting provider]”.
That leaves the catalog. It was generated two minutes before the email went out, with my name in the file properties. Assembly-line work, freshly packaged for each recipient. Technically, by the way, the email was flawless: it passed all the usual authenticity checks. But that only proves it really came from that domain. It doesn't prove there's a lawyer behind it.
The next day, I filed a criminal complaint.
I played the buyer
After that I got a call back, with the number from the email on the display. On the phone: good German, slight accent. Yes, they really were selling. When I said I thought it was a scam, the person hung up.
I wanted to know how far they would go. Under a different name, I asked about the Volvo. The answer came promptly: an order confirmation and a purchase contract, please sign and send back. “The invoice with the payment information will only follow after that.” He also wanted my phone number.
That's how the scam works. The contract and the invoice look proper. In the end, you transfer a lot of money to strangers.
Then I insulted him. On purpose.
On the evening of November 2, I dropped the mask. I wrote to him from my own address and insulted him. My thinking: a pro ignores something like that. A beginner gets angry, and people who are angry talk.
He talked.
The next morning, just before seven, someone visited ENDE.APP through a server in Bulgaria and opened my contact page. Four minutes later his reply came in, for the first time with my name. After that he wrote to me all day, one email after another. In the process, he gave away a lot:
- He writes with Thunderbird on Windows, and his computer runs on universal time (UTC).
- He said he was “from the East” and based in the United Arab Emirates, with proxies and virtual machines. Or so he bragged.
- He wanted to keep talking in a chat and sent me his ID for it.
- And he openly admitted the scam: “enough people fall for such banal shit :)”
I even gave him some tutoring: pros don't give anything away, stay calm, and don't visit the websites of people who annoy them. He broke all three rules.
My site buckled
His first email that morning ended with a threat: “PS: your website's going down in a sec.”
It started in the early afternoon. First came masses of page requests through constantly changing proxy servers. Just before two, a flood of connections followed from around 1,400 IP addresses. ENDE.APP could no longer be reached. Half an hour later, the next wave rolled in.
It didn't take him much effort, he wrote. The whole thing took “barely any time”, just “one order”.
The smear site
Around noon he had already announced what would come next: a website with my details and my picture, making me out to be a sex offender. An AI would build it, he said.
In the afternoon he sent the preview. My name, my photo, ENDE.APP, my Instagram account. Plus the made-up accusations. He would submit the site to Google and send it to my supporters. They're listed on my thank-you page. “They were easy to find too”, he wrote.
Then he turned racist. And he wrote a sentence that says a lot about him: “just like destroying lives”.
Shortly after, his last email came in. The site would go on a Russian server with a .to domain, so it would be hard to take down. He would only take it offline if I apologized to him.
Instead of an apology, everything went to the police and to the Lower Saxony State Criminal Police Office (Landeskriminalamt Niedersachsen), along with the server logs. To me, that's computer sabotage, defamation and coercion. And this article is my answer.
Scam fact sheet
All the telltale signs at a glance. Use them to recognize emails and sites from this scam.
- Name: “Attorney Kerk Behrens”. The name belongs to a real lawyer who has nothing to do with it.
- Websites: rechtmuenster.de and jb-arbeitsrecht.de, which redirects to rechtmuenster.de.
- Email addresses:
anfrage@jb-arbeitsrecht.de,kbehrens@rechtmuenster.deandinfo@rechtmuenster.de - Phone numbers: +49 251 92 754 754 and +49 251 92754322. Whether they belong to the perpetrators or are being misused is an open question.
- Claimed address: Overbergstraße 21, 48151 Münster. The postal code is wrong.
- Subject: “z.H. Sascha - Kneissl Design FS04 E-Mountainbike Fully für 1.900 € - Verwertung läuft”. The first name varies.
- Attachment: “Katalog_1564.pdf” with 110 items and the recipient's name in the file properties.
- Goods: e-mountain bikes from Kneissl and Focus and a Volvo XC60, from 1,900 euros.
- Data source: supposedly Databyte. Databyte says that's false.
- Process: first an order confirmation and a purchase contract, then the invoice with the payment details.
- Tech: The domains run through Cloudflare and are registered with Dynadot and Porkbun. The first email came through Amazon SES, the later ones through the mail service Purelymail.
These services are just providers, not perpetrators. But they do accept abuse reports. Report the sites to Dynadot (rechtmuenster.de), Porkbun (jb-arbeitsrecht.de) and Cloudflare (both), and the emails to Amazon at email-abuse@amazon.com.
What you can do
How to spot the scam:
- A law firm offers you insolvency goods out of the blue, at fixed prices and under time pressure.
- The email names a source for your details, for example Databyte.
- The domain is new, the address or postal code doesn't match.
- First comes a contract, the payment details follow later.
What you should do:
- Don't reply, don't sign anything, don't transfer any money.
- Look up the lawyer in the official nationwide German lawyer directory (Bundesweites Amtliches Anwaltsverzeichnis). But careful: the scammers like to use real names, just like here.
- Ask the real law firm, using the number from the directory, never the one from the email.
- Check at insolvenzbekanntmachungen.de whether the insolvency proceedings even exist.
- Keep the email as a file, for example as an EML. A screenshot doesn't show where the email really came from.
Where to report the scam:
- To the police, online via your German state's online police station (Onlinewache or Internetwache).
- To the bar association where the law firm claims to be based, in this case the Hamm Bar Association (Rechtsanwaltskammer Hamm). The German Federal Bar (Bundesrechtsanwaltskammer) has an overview of the bar associations.
- To the real law firm whose name is being misused.
- If your website or company is under attack: to the Central Cybercrime Contact Point (Zentrale Ansprechstelle Cybercrime, ZAC) of your state's criminal police office (Landeskriminalamt). Back up your server logs first.
And one honest word to finish: provoking the scammer revealed a lot. But it also got me a crippled website and the threat of a smear site. If you're not up for that: don't reply, report, delete.
You'll find more details in the German Federal Bar's guidance on fake law firms (PDF).
The full email
So you can recognize it, here's the complete email from October 29, 2026:
Subject: z.H. Sascha - Kneissl Design FS04 E-Mountainbike Fully für 1.900 € - Verwertung läuft
From: Attorney Kerk Behrens,anfrage@jb-arbeitsrecht.deHello Sascha,
As part of an ongoing liquidation procedure, I am currently clearing out the stock of a company that has ceased production. The items are one-offs from a business that has ended its operations, and they are now being sold directly to companies that use this kind of equipment. An on-site viewing is possible at any time by appointment, and the catalog with all 110 items is attached. The most notable pieces include the Kneissl Design FS04 full-suspension e-mountain bike for €1,900, the Focus Jam² SL 8.8 e-mountain bike for €2,300 and the Volvo XC60 B5 AWD Ultra Dark Mild-Hybrid for €31,100.
These are the fixed liquidation prices from the proceedings, not open to haggling. Each item is documented in the catalog with a picture, year of manufacture and condition, and each also has its own catalog number and price. As for the stock: what's sold is gone. It will not be possible to get it again on these terms later.
The sale is handled through a purchase contract with an invoice, and the handover takes place directly on site by appointment. If several items are relevant to you, a package price can be agreed. A short message with the catalog number is enough, and I will get back to you right away with all the details on condition and availability. If you would like to know more about an item, just ask.
I also answer questions by phone. You can reach me at 0251 92754754.
I got your details from Databyte's company database. If I don't hear back from you, I won't write to you a second time.
Best regards,
Kerk BehrensKerk Behrens
Attorney at law
Overbergstraße 21 · 48151 Münster
Phone +49 251 92 754 754
anfrage@jb-arbeitsrecht.de·www.jb-arbeitsrecht.deDon't want any more emails from us? Reply with “Unsubscribe” as the subject or just reply. We'll remove you right away.