docs-insight-tatsu[.]gate-cryptolist[.]com

Analysis date July 29 2026. The domain docs-insight-tatsu.gate-cryptolist.com was registered on June 17 2024 through Key-Systems GmbH. It is hosted on IP 188.114.97.3 and uses Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. HTTP requests return status code 200, indicating an active web server. The domain is listed on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal scans show that 13 of 91 security vendors have flagged the domain, providing additional corroboration of malicious intent. No further public intelligence such as Safe Browsing or OTX entries is supplied.

The available evidence points to a generic phishing operation, but the specific payload, target brand, or page content has not been disclosed in the current dataset. Consequently, the precise scam technique and victim profile remain uncertain. The high risk rating assigned to the domain reflects the combination of its recent creation, active web service, and multiple vendor detections. Although only one blocklist currently references the domain, the presence on PhishDestroy indicates that it has been observed in phishing takedowns. The lack of SSL certificate details in the supplied data prevents verification of HTTPS usage, so monitoring for TLS deployment is advisable. Because the registrar is a well-known provider, threat actors may be exploiting legitimate registration channels to obtain short-lived domains.

The short lifespan between registration and detection suggests a fast-flux style deployment, common in phishing campaigns targeting financial or credential theft. Defenders should add the domain to deny-list rules, monitor DNS queries for the IP 188.114.97.3, and enforce outbound filtering for HTTP traffic to this host. Continuous re-scanning on VirusTotal and inclusion in threat-intel feeds are recommended to capture any evolution of the campaign.