remalo68[.]eu

The domain remalo68.eu is currently active and has been observed on a security blocklist. Its authoritative name servers are damiete.ns.cloudflare.com and naya.ns.cloudflare.com (listed twice), indicating use of Cloudflare’s DNS infrastructure. Registration was performed through InterNetX GmbH, and the domain resolves to the IP address 188.114.96.3, a host that is commonly associated with Cloudflare‑protected services.

The domain has been scanned by 95 antivirus and URL‑reputation vendors on VirusTotal, none of which reported a detection at the time of analysis. It is also listed as blocked by PhishDestroy, suggesting that at least one anti‑phishing service has identified it as malicious. No public information about the page title, SSL certificate details, HTTP response codes, or specific brand impersonation is available, so the exact content and targeted victim profile remain uncertain.

The lack of detections does not imply safety, and the absence of detailed page metadata limits attribution of the phishing kit or campaign. Defenders should continue to monitor DNS queries for remalo68.eu, enforce blocklisting at network perimeter and endpoint security solutions, and consider adding the domain to internal threat intelligence feeds. Additional investigation, such as retrieving the landing page content and analyzing any submitted credentials, is recommended to clarify the scope of the credential‑harvesting operation and to support remediation actions.