babykekiusmaximus[.]gate-cryptolist[.]com

The domain babykekiusmaximus.gate-cryptolist.com is actively hosting a fake exchange phishing site. The site returns HTTP 200 and presents the page title "Just a moment..."; no further content analysis is available. Registration data shows the domain was created on 17 June 2024 through Key-Systems GmbH, and it is served via Cloudflare nameservers (dale.ns.cloudflare.com, vera.ns.cloudflare.com) resolving to IP 188.114.97.3, which GeoIP maps to Canada and is owned by Cloudflare, Inc. The TLS certificate is issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS endpoint. Security scoring from Gridinsoft is 0/100, and the domain appears on a single blocklist (PhishDestroy). VirusTotal records indicate that 14 of 91 security vendors have flagged the domain, confirming malicious intent. The observed phishing kit is identified as a Seed Phrase Phishing kit, aligning with the reported fake exchange scam type. Defenders should immediately block the domain and its resolving IP at perimeter and DNS filtering layers, ingest the domain and IP as IOCs, and monitor for any outbound connections to the IP address. Because the page content has not been fully examined, further analysis of the payload and any credential harvesting forms is recommended to determine the full scope of the campaign.