rem753[.]it

The domain rem753.it was registered through 1 Api GmbH on 12 January 2025 and is presently taken offline. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative name servers listed are bonnie.ns.cloudflare.com and julio.ns.cloudflare.com, both hosted on the Cloudflare platform. No TLS certificate was observed for the domain, indicating that HTTPS was not configured at the time of analysis.

The sole visible page returned the title “Welcome aboard,” but the content of the page has not been examined further. Gridinsoft assigned a trust score of 0 out of 100, reflecting a very low confidence rating. VirusTotal reports that two out of ninety‑five scanned security vendors flagged the domain, providing limited but notable malicious indication. The domain is currently listed on one security blocklist and has been blocked by the PhishDestroy service, confirming that at least one anti‑phishing community has taken remedial action.

Uncertainties remain regarding the specific phishing campaign or credential‑harvesting techniques employed, as no additional artifacts such as phishing kits, targeted brands, or payload URLs have been disclosed. Defenders should continue to monitor the IP 188.114.96.3 for any re‑activation, enforce blocklisting of the domain in web filtering solutions, and consider adding the associated IP range to threat‑intel feeds. Additional investigation, such as retrieving archived HTTP responses or conducting passive DNS look‑ups, may yield further context about the infrastructure’s intended use.