gatavalen[.]cc

The domain gatavalen.cc was registered on February 4, 2025 through NiceNIC International Group Co., Limited and is currently active. DNS resolution points to IP 31.59.185.53, which is assigned to AS56594 CGI GLOBAL LIMITED in the Netherlands. The site serves an HTTP 200 response and presents the page title “Blockchain Payout Notification,” indicating a crypto‑related scam. The TLS certificate is provided by Let’s Encrypt (R13), and the authoritative name servers are a.dnspod.com, b.dnspod.com, and c.dnspod.com. Threat intelligence shows the domain appears on one security blocklist, is blocked by PhishDestroy, and has been referenced in 18 AlienVault OTX pulses. VirusTotal analysis recorded 20 detections out of 93 scanned security vendors, reinforcing the high‑risk assessment. Scamadviser and Gridinsoft both assign a trust score of 1/100, confirming the malicious intent. While the exact content of the page has not been examined, the combination of a convincing blockchain payout title, low trust scores, and multiple vendor detections suggests the site is being used to lure victims into disclosing cryptocurrency credentials or making payments. Defenders should immediately block the domain and its hosting IP, add the associated name servers to deny‑list rules, and monitor outbound traffic for connections to 31.59.185.53. Continuous updates to intrusion detection signatures and threat feeds are recommended to capture any derivative infrastructure that may arise from this campaign.