brotherhood[.]gate-cryptolist[.]com

Analysis of the domain brotherhood.gate-cryptolist.com indicates it is actively associated with phishing activity targeting cryptocurrency users. The domain was registered on June 17, 2024, through Key-Systems GmbH, a registrar frequently utilized for both legitimate and malicious domains. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, which is hosted on Cloudflare’s network, a common tactic to obscure hosting origins and evade IP-based blocking. Nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com further confirm Cloudflare’s involvement in the domain’s DNS resolution.

As of July 29, 2026, the domain is flagged by 15 of 91 security vendors on VirusTotal, a detection rate consistent with known phishing infrastructure. Additionally, it appears on at least one security blocklist, specifically PhishDestroy, which categorizes it as a phishing threat. No further details regarding the specific brand or cryptocurrency platform being impersonated are available in the current intelligence, nor is there evidence of the exact phishing kit or payload in use. The absence of additional context, such as Safe Browsing classifications or Open Threat Exchange (OTX) reports, limits a full assessment of its operational scope.

Defenders are advised to treat this domain as an active threat. Network-level blocking of the IP 188.114.97.3 and the domain itself is recommended for organizations with exposure to cryptocurrency-related traffic. Security teams should monitor for connections to this infrastructure, particularly in environments where cryptocurrency transactions or wallet interactions occur. Given the elevated detection rate and blocklist inclusion, this domain warrants heightened scrutiny, though further analysis of its payload or target brand is necessary for a complete mitigation strategy.