bad-coin[.]gate-cryptolist[.]com

The domain bad-coin.gate-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and is currently active with an elevated risk rating. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3 and uses Cloudflare name servers dale.ns.cloudflare.com and vera.ns.cloudflare.com, indicating it is hosted behind a content‑delivery network that can mask the true origin of the malicious content. VirusTotal has recorded 13 detections out of 91 scanned security vendors, confirming that multiple antivirus and URL‑filtering engines flag the site as malicious.

The domain appears on one external blocklist and is specifically blocked by the PhishDestroy service, providing additional evidence of its use in phishing campaigns. No further details such as SSL certificate attributes, HTTP response codes, or page title have been disclosed, so the exact appearance of the site remains uncertain.

Defenders should add the domain and its resolving IP to outbound filtering rules, monitor DNS queries for look‑ups to the Cloudflare name servers, and ensure that any credential‑capture attempts targeting users are blocked. Continuous re‑scanning of the domain with sandbox tools is advised to capture any evolving payloads, and security teams should share observed indicators with threat‑intel communities to improve collective detection capabilities.