clpi[.]alpikor[.]de

The domain clpi.alpikor.de is currently active and returns HTTP 200 responses without an SSL certificate, indicating that any traffic to the site is unencrypted. The sole visible page title reads “Verifying your connection…”, a phrase commonly employed in credential‑harvesting flows to suggest a temporary verification step. Infrastructure analysis shows the domain resolves to the IPv4 address 178.16.53.131, which is registered to the Netherlands and is announced by AS202412 owned by Omegatech LTD. The host is served by the authoritative name servers ns1.regery.net, ns2.regery.net and ns3.regery.net. Reputation signals are strongly negative.

Scamadviser assigns a trust score of 1 / 100, reflecting a near‑zero confidence rating. VirusTotal records indicate that 13 of 95 scanned security vendors have flagged the domain as malicious, corroborating the suspicion raised by the page title. The domain appears on a single security blocklist and is explicitly listed by the PhishDestroy service, confirming that at least one dedicated anti‑phishing platform has taken remediation action. No TLS certificate is present, which prevents browsers from presenting standard security indicators and may facilitate man‑in‑the‑middle interception. The HTTP 200 status suggests the server is deliberately configured to deliver content rather than a default error page, a behavior typical of active phishing infrastructure.

The lack of additional public intelligence such as Safe Browsing or Open Threat Exchange entries limits the broader contextual picture, and the exact phishing kit or targeted brand cannot be confirmed from the available data. Defenders should immediately block DNS resolution for clpi.alpikor.de and the associated IP address 178.16.53.131 at network perimeters. Adding the domain to internal URL filtering lists and to external blocklists used by security appliances will reduce exposure.