rna-pepe[.]gate-cryptolist[.]com

This domain, rna-pepe.gate-cryptolist.com, is flagged as an active cryptocurrency-related phishing threat with elevated risk. Registered on June 17, 2024, through Key-Systems GmbH, the domain resolves to IP address 188.114.97.3 and uses Cloudflare nameservers (dale.ns.cloudflare.com and vera.ns.cloudflare.com). Infrastructure analysis reveals Cloudflare hosting, which is commonly used to obscure malicious activity behind proxy services. The domain appears on one security blocklist and is blocked by PhishDestroy.

VirusTotal detections show 13 of 91 security vendors flagging the domain as malicious, indicating a consensus among multiple detection engines regarding its threat status. The exact content and target of the phishing scheme are not yet fully analyzed, but the domain name suggests a focus on cryptocurrency users, potentially leveraging social engineering tactics. Defenders should treat this domain as hostile and prioritize blocking it at the DNS and network perimeter levels.

The use of Cloudflare nameservers may complicate origin tracing, but the resolved IP and registrar details provide actionable indicators for threat hunting. No SSL certificate or HTTP status details are currently available, so additional monitoring of encrypted traffic and endpoint behavior is recommended. Given the domain's recent creation and active detection by security vendors, it is likely part of an ongoing phishing campaign targeting cryptocurrency wallets or exchanges.