epay-2[.]gate-cryptolist[.]com

Analysis of epay-2.gate-cryptolist.com indicates an active cryptocurrency-related phishing domain with elevated risk. The domain was registered on June 17, 2024, through Key-Systems GmbH, a registrar commonly used for both legitimate and malicious registrations. Infrastructure analysis reveals it resolves to IP address 188.114.96.3, hosted on Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com, a configuration frequently observed in phishing campaigns due to Cloudflare’s proxy services masking the true origin.

As of July 29, 2026, the domain is flagged by 14 of 91 security vendors on VirusTotal, a detection rate consistent with confirmed phishing activity. It also appears on at least one security blocklist, further corroborating its malicious classification by the security community. The domain’s name, containing 'epay' and 'crypto,' suggests an intent to deceive users into believing it is a legitimate cryptocurrency payment or gateway service.

No specific brand impersonation or exact page content has been confirmed in available data, but the structure aligns with common phishing tactics targeting digital asset transactions. Defenders should treat this domain as compromised infrastructure and implement blocking at the DNS or network level. Organizations are advised to monitor for connections to 188.114.96.3 and review logs for any user interaction with epay-2.gate-cryptolist.com, particularly in contexts involving cryptocurrency transactions or credential submission.