pongo-2[.]gate-cryptolist[.]com

pongo-2.gate-cryptolist.com is currently active and has been classified as a generic phishing site. The domain was registered on June 17 2024 through Key-Systems GmbH and is hosted on the IP address 188.114.97.3, which resolves to Cloudflare’s network. Authoritative nameservers are dale.ns.cloudflare.com and vera.ns.cloudflare.com, confirming that the domain is being served behind Cloudflare’s edge infrastructure. VirusTotal has recorded 14 of 91 security vendors flagging the domain, indicating a moderate level of consensus among scanners that the site is malicious.

The domain is listed on at least one public security blocklist and has been added to the PhishDestroy feed, demonstrating that multiple threat‑intelligence providers have already taken mitigation actions. No public SSL certificate details, HTTP status codes, Safe Browsing verdicts, or page‑title information are available in the supplied intelligence, so the exact content served by the site remains unknown. Defenders should treat any traffic to this host as hostile. Immediate actions include adding the domain and its resolving IP to outbound and inbound deny lists, updating DNS‑filtering solutions to block the domain, and ensuring that intrusion‑detection signatures that reference the observed VirusTotal detections are deployed.

Monitoring for newly observed C2 infrastructure or credential‑harvesting endpoints that resolve to the same Cloudflare IP is recommended, as threat actors often reuse the same edge services for multiple campaigns. Because the registrar is a well‑known service provider, domain‑take‑down requests may be viable if evidence of abuse is gathered. Continuous re‑evaluation of the domain’s status in threat‑intel feeds is advised, as additional detections or changes in classification could affect response priorities.