srem[.]hr

Analysis as of July 22 2026 indicates that the domain srem.hr was registered on 28 April 2026 and is currently hosted on the IP address 216.198.79.65. The authoritative nameservers are penny.ns.cloudflare.com and scott.ns.cloudflare.com, confirming that the domain is serviced through Cloudflare’s DNS infrastructure. The domain appears on a single security blocklist and is explicitly listed by the PhishDestroy feed, which classifies it as a malicious phishing indicator.

VirusTotal records show that the domain has been examined by 95 AV scanners, none of which have raised a detection; this absence of detections does not constitute a safety assurance and may reflect limited coverage of the payload or evasion techniques. No public Safe Browsing, OTX, or other reputation services have published additional verdicts for srem.hr, and no SSL certificate details, HTTP response codes, or page title information are available in the current intelligence set. Consequently, the observable surface suggests a newly created infrastructure that is actively used for generic phishing campaigns, but the lack of corroborating evidence limits the ability to attribute a specific target brand or phishing kit.

Defenders should add srem.hr to deny‑list rules at the DNS and proxy layers, monitor outbound connections to 216.198.79.65, and enforce URL filtering that includes the PhishDestroy blocklist entry. Continuous re‑evaluation is advised, as future scans may reveal malicious payloads or additional indicators that could change the risk posture.