rem-token[.]gate-cryptolist[.]com

rem-token.gate-cryptolist.com is currently flagged as an active generic phishing infrastructure with an elevated risk rating. The domain resolves to the IPv4 address 188.114.96.3, which is the sole A record observed. Registration data indicate the domain was created on 17 June 2024 through the registrar Key-Systems GmbH, a known provider for many short‑lived malicious domains. The authoritative nameservers are dale.ns.cloudflare.com and vera.ns.cloudflare.com, both belonging to Cloudflare’s DNS service, suggesting the operator is leveraging a reputable DNS provider to increase reliability.

VirusTotal analysis shows that 14 out of 91 scanned security vendors have reported the domain as malicious, confirming a consensus among multiple detection engines. The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy feed, providing immediate mitigation capability for organizations that consume that feed. No additional public intelligence such as Safe Browsing or OTX entries is presently available, and the content of the landing page has not been publicly disclosed, leaving the exact phishing lure unknown.

Defenders should add the domain and its resolved IP address to outbound and inbound deny lists, monitor DNS queries for the associated Cloudflare nameservers, and ensure that any email filtering solutions reference the PhishDestroy blocklist. Continuous re‑scanning on VirusTotal or similar platforms is recommended to capture any change in detection rates. Given the recent creation date and active status, the infrastructure is likely still in early deployment, and rapid block‑and‑monitor actions are advised to reduce exposure.