kikicat[.]gate-cryptolist[.]com

The domain kikicat.gate-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH. It is currently hosted on the IP address 188.114.97.3 and uses Cloudflare name servers dale.ns.cloudflare.com and vera.ns.cloudflare.com. VirusTotal reports that 13 of 91 scanned security vendors flag the domain as malicious, indicating a consensus of detection across multiple engines. The domain appears on a single external blocklist and is explicitly listed by the PhishDestroy service, confirming that it has been identified as a phishing vector.

The elevated risk rating aligns with the observed detection count and blocklist presence. No additional public intelligence such as Safe Browsing status, OTX references, or SSL certificate details are available, leaving the full scope of the campaign’s payload and target branding unverified. The sub‑domain structure suggests it may be leveraging the broader gate-cryptolist.com namespace, a pattern observed in prior credential‑stealing operations.

Because the site serves only a single IP, sink‑hole deployment at 188.114.97.3 could disrupt traffic. Analysts should block network traffic to the domain and its resolved IP, add the domain to internal deny lists, monitor DNS logs for historical resolutions, and continuously re‑evaluate blocklist status. Further investigation of the hosting provider and any associated sub‑domains is advised to assess the broader infrastructure and to mitigate potential credential harvesting attempts.