cointel[.]next-cryptolist[.]net

This domain, cointel.next-cryptolist.net, was registered on September 16, 2025 through Key-Systems GmbH and remains active as of the report date. DNS resolution points to the Cloudflare‑hosted address 104.21.64.107 and the authoritative nameservers are hunts.ns.cloudflare.com and nena.ns.cloudflare.com, indicating that the infrastructure is being leveraged through Cloudflare’s network. HTTP requests to the host return a 403 status code, which suggests that the web server is deliberately restricting access, a behavior commonly observed in malicious drop sites that serve content only to specific user‑agents or after credential capture. VirusTotal has recorded 17 detections out of 91 scanned security engines, confirming that a notable portion of the security community considers the domain malicious.

The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy filtering service, providing additional evidence of its use in phishing operations. No public page title or SSL certificate details have been disclosed, limiting visibility into the exact lure employed. The lack of further intelligence such as targeted brand, kit, or detailed payload means that the full scope of the campaign cannot be precisely defined at this time.

Defenders should therefore treat cointel.next-cryptolist.net as a high‑risk indicator. Recommended actions include adding the domain and its resolving IP address (104.21.64.107) to network and DNS block lists, monitoring for any outbound connections to the host, and enabling heuristic or reputation‑based blocking in web proxies. Continuous re‑evaluation is advised, as the threat actors may activate additional infrastructure or modify the site to bypass current defenses.