yellow-pepe-vip[.]gate-cryptolist[.]com

The domain yellow-pepe-vip.gate-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and currently resolves to the IPv4 address 188.114.96.3. DNS resolution is serviced by Cloudflare name servers (dale.ns.cloudflare.com and vera.ns.cloudflare.com), indicating the use of a reputable DNS provider to obscure the true hosting location. VirusTotal analysis shows that 14 of 91 security vendors have flagged the domain as malicious, confirming that a notable subset of scanners recognize it as a phishing vector. The domain is actively listed on a security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing its classification as a threat.

The operational status is marked as active with an elevated risk rating, suggesting ongoing malicious activity. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available at this time, leaving the exact content and lure tactics unverified. Defenders should prioritize the inclusion of the domain and its resolving IP address (188.114.96.3) in network‑level deny lists, endpoint protection rules, and DNS filtering policies.

Continuous monitoring of traffic to the associated Cloudflare name servers is advised to detect any pivoting or re‑use of the infrastructure. Organizations employing threat‑intelligence platforms should ingest the VirusTotal detection count and blocklist entries to enrich detection signatures. Given the limited public artifact set, further investigation—such as sandbox execution of the site’s landing page—would be required to fully characterize the phishing payload and confirm any credential‑harvesting mechanisms.