catalyse-ai[.]gate-cryptolist[.]com

Analysis of the domain catalyse-ai.gate-cryptolist.com indicates an active high-risk phishing campaign targeting users of artificial intelligence platforms. The domain was registered on June 17, 2024, through Key-Systems GmbH and currently resolves to the IP address 188.114.96.3. Infrastructure analysis reveals Cloudflare nameservers (dale.ns.cloudflare.com and vera.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. As of July 29, 2026, the domain remains operational, returning an HTTP 200 status code, which suggests the phishing page is actively serving content. VirusTotal telemetry shows 14 of 91 security vendors flagging the domain as malicious, a detection rate consistent with credential-harvesting infrastructure.

The domain appears on one security blocklist, specifically PhishDestroy, further corroborating its classification as a phishing threat. No brand name or specific AI service is explicitly confirmed in the available evidence, though the subdomain 'catalyse-ai' implies an attempt to impersonate an AI-related service. The exact nature of the phishing content—such as whether it mimics a login portal, API key request, or subscription scam—remains unconfirmed due to the absence of page-level analysis. Defenders should prioritize blocking the domain and its resolving IP (188.114.96.3) at the network level.

Given the use of Cloudflare, sinkholing DNS queries to the listed nameservers may also disrupt the campaign. Organizations operating AI platforms or services should monitor for unauthorized access attempts linked to credentials potentially harvested via this domain. The registrar, Key-Systems GmbH, should be notified to facilitate potential suspension under anti-abuse policies. No additional threat intelligence platforms (e.g., Google Safe Browsing, OTX) or SSL certificate anomalies are reported in the current dataset.