phoenix-global-new[.]gate-cryptolist[.]com

Analysis of the domain phoenix-global-new.gate-cryptolist.com indicates it is an active cryptocurrency-themed phishing site, registered on June 17, 2024, through Key-Systems GmbH. The domain resolves to the IP address 188.114.97.3, which is associated with Cloudflare infrastructure, as evidenced by the nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. As of July 29, 2026, the domain is flagged by 15 of 91 security vendors on VirusTotal, suggesting a moderate level of detection, and appears on one security blocklist, specifically PhishDestroy. The elevated risk classification is supported by these detections, though the exact nature of the phishing content remains unconfirmed due to the absence of detailed page analysis or identified phishing kit signatures.

Defenders should note that the domain's registration date, approximately two years prior to the report, does not align with typical short-lived phishing campaigns, which may indicate either prolonged use or delayed detection. The use of Cloudflare nameservers and hosting is consistent with threat actors leveraging content delivery networks to obscure origin infrastructure and evade takedown efforts. While the domain's cryptocurrency-related naming convention suggests a likely target, no specific brand or service impersonation has been confirmed in the available data.

Recommended actions include blocking the domain and its resolving IP at the network perimeter, monitoring for related subdomains or newly registered domains under the same registrar, and submitting the domain to additional threat intelligence feeds for broader visibility. Given the Cloudflare hosting, defenders may also consider implementing stricter policies for traffic to known CDN IP ranges associated with malicious activity. Further investigation into the domain's SSL certificate, HTTP response headers, and any associated malware samples could provide additional context for attribution or campaign tracking.