soonchain[.]gate-cryptolist[.]com

Analysis of soonchain.gate-cryptolist.com indicates an active phishing domain targeting cryptocurrency users. The domain was registered on June 17, 2024, through Key-Systems GmbH and is currently resolving to IP address 188.114.97.3, which is associated with Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. This infrastructure choice is consistent with threat actors leveraging Cloudflare's services to obscure hosting origins and evade takedowns. As of July 29, 2026, the domain appears on one security blocklist and is flagged by PhishDestroy, suggesting prior detection by at least one anti-phishing vendor.

VirusTotal reports 13 of 91 security vendors marking the domain as malicious, though the specific nature of the threat—such as whether it hosts a credential harvester, fake wallet, or crypto drainer—remains unconfirmed due to lack of detailed page analysis. The domain's naming convention, incorporating 'gate' and 'crypto,' implies an attempt to impersonate a cryptocurrency exchange or payment gateway, though no specific brand is confirmed in available evidence. The registration age of over a year may indicate either prolonged malicious use or a dormant domain recently activated for phishing campaigns.

Defenders should treat this domain as elevated risk, particularly in environments where cryptocurrency-related activity occurs. Recommended actions include blocking the domain at DNS and web proxy levels, monitoring for connections to the associated IP address 188.114.97.3, and reviewing logs for user interactions with the domain. Further investigation into the exact phishing kit or payload is warranted, though no HTTP status, SSL certificate details, or page title data is currently available to clarify the attack vector.