en-monero[.]gr[.]com

Analysis indicates that en-monero.gr.com is currently hosting a web service that returns HTTP 200 and presents the page title "Welcome". The domain is registered via Key-Systems GmbH and uses Cloudflare's DNS and edge services, as indicated by the nameservers (ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, ns4.centralnic.net) and the resolved IP address 172.67.201.216, which belongs to Cloudflare, Inc. The site is protected by a Let’s Encrypt certificate (E8) and serves content over HTTP/3, with Cloudflare Browser Insights detected. Threat intelligence shows that five of ninety‑one security scanners on VirusTotal have flagged the domain, and Gridinsoft assigns a trust score of 0/100. The domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. The combination of a generic "Welcome" page, high‑risk rating, and multiple detections aligns with a generic phishing operation, though the specific payload or targeted brand has not been disclosed. Defenders should continue to block traffic to this host, monitor DNS queries for the associated Cloudflare IP range, and consider adding the domain to internal blocklists. Ongoing observation is recommended to capture any changes in content or additional indicators that could clarify the phishing campaign's objectives.