creatx[.]gate-cryptolist[.]com

creatx.gate-cryptolist.com is currently classified as a high‑risk generic phishing domain. The registration record shows the domain was created on 17 June 2024 and was processed through the registrar Key-Systems GmbH. DNS resolution points to the IP address 188.114.96.3, which is served by Cloudflare infrastructure using the authoritative name servers dale.ns.cloudflare.com and vera.ns.cloudflare.com. An HTTP request to the host returns a 200 OK status, confirming that a web service is actively responding.

Reputation checks indicate the domain appears on one public security blocklist and is actively blocked by the PhishDestroy sinkhole, providing additional confirmation of malicious intent. VirusTotal scanning has resulted in 14 of 91 engines labeling the domain as malicious, indicating a measurable detection rate across multiple security vendors. No public Safe Browsing verdicts, Open Threat Exchange tags, or SSL certificate information are presently available, leaving those vectors unverified. The observed infrastructure—registration date, hosting on a Cloudflare‑backed IP, and the modest detection count—suggests a purpose‑built phishing campaign that may be leveraging the gate‑cryptolist.com sub‑domain to gain credibility.

Defenders should update network and DNS blocklists to include both the domain name and the associated IP address, enforce web‑filtering policies that deny traffic to the host, and ensure endpoint detection platforms ingest the VirusTotal detection count for correlation. Continuous monitoring of DNS changes, HTTP response behavior, and any new detection signatures is recommended to capture potential campaign evolution or shifts in hosting resources. Organizations should also review email gateway logs for outbound or inbound references to the domain and consider user awareness alerts that reference the specific URL to reduce the likelihood of successful credential harvesting.