zerepy[.]gate-cryptolist[.]com

Analysis of zerepy.gate-cryptolist.com indicates that the domain was registered on 17 June 2024 through Key-Systems GmbH and is hosted on the IP address 188.114.97.3. The authoritative nameservers are dale.ns.cloudflare.com and vera.ns.cloudflare.com, confirming that the domain uses Cloudflare’s DNS infrastructure. Passive DNS records show that the domain resolves consistently to the same IP, suggesting a stable hosting arrangement rather than a fast‑flux network. The domain has been listed by the PhishDestroy blocklist and appears on one additional security blocklist, demonstrating that at least one external threat‑intelligence feed has identified it as malicious.

VirusTotal scans show that 14 of 91 security vendors flagged the domain, providing multi‑engine corroboration of suspicious activity. No public SSL certificate details, HTTP response codes, or page title information are available in the current intelligence set, leaving the exact content of the landing page unverified. The lack of visible page metadata prevents confirmation of the specific phishing lure employed, but the classification as a generic phishing site is supported by the blocklist entries and vendor detections. Defenders should block DNS resolution to the domain, add the IP address 188.114.97.3 to network‑level deny lists, and monitor traffic for any outbound connections to the Cloudflare nameservers associated with this domain.

Continuous re‑scanning with multi‑engine services is recommended to capture any changes in the payload or hosting infrastructure. Organizations that employ email filtering should ensure that URLs containing the domain are quarantined, and users should be warned against clicking links that reference the gate-cryptolist.com sub‑domain. Because the domain’s content has not been publicly disclosed, further investigation, such as sandboxing of the landing page, would be required to detail the credential‑harvesting techniques in use.