gout[.]next-cryptolist[.]net

This domain, gout.next-cryptolist.net, is actively flagged as a high-risk cryptocurrency phishing site. Infrastructure analysis reveals it was registered on April 11, 2026, through Key-Systems GmbH and is currently resolving to the IP address 172.67.181.166, hosted behind Cloudflare infrastructure in Canada. The domain employs Cloudflare nameservers (hunts.ns.cloudflare.com, nena.ns.cloudflare.com) and supports HTTP/3, a configuration commonly observed in modern phishing campaigns to evade detection and enhance delivery speed. A Google Trust Services SSL certificate (WE1) is in place, providing encrypted connections that may lend false legitimacy to targets. Security vendors have detected malicious activity associated with this domain, with 18 of 94 engines on VirusTotal identifying it as harmful. The domain appears on at least one security blocklist and is actively blocked by PhishDestroy. Despite these indicators, the site currently returns an HTTP 403 status, suggesting either a deliberate access restriction or a temporary operational state. The exact content and targeted brand or platform remain unconfirmed, as no page title or specific scam kit details are available in the current intelligence. Defenders should treat this domain as an active threat. The use of Cloudflare infrastructure, combined with a recent registration and confirmed security detections, indicates a deliberate phishing operation. Network-level blocking is recommended, and further analysis should include monitoring for changes in HTTP status, domain resolution, or SSL certificate updates. Given the domain's association with cryptocurrency-related terminology, it is likely targeting users of digital asset platforms, though this cannot be confirmed without additional evidence.