gooey-guys[.]gate-cryptolist[.]com

Analysis of gooey-guys.gate-cryptolist.com indicates active phishing infrastructure. The domain resolves to the IPv4 address 188.114.96.3 and is serviced by Cloudflare DNS, as shown by the authoritative nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. Registration data reveal that the domain was created on 17 June 2024 through the registrar Key-Systems GmbH, a common provider for both legitimate and malicious registrations. The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one threat‑intelligence feed has identified malicious use.

VirusTotal scans show that 14 of 91 security vendors have flagged the domain, suggesting a moderate level of detection across multiple engines. No additional public intelligence such as Safe Browsing alerts, OTX indicators, SSL certificate details, HTTP response codes, or page‑title information is currently available. The lack of visible page metadata limits the ability to attribute a specific brand or phishing lure, but the classification as generic phishing remains supported by the detection profile.

Defenders should prioritize blocking the domain at DNS and proxy layers, blacklist the associated IP address, and monitor traffic for any connections to the Cloudflare nameservers that could indicate related infrastructure reuse. Continuous re‑scanning on VirusTotal and inclusion in internal blocklists are recommended to capture any escalation in vendor detections. Given the recent creation date and active blocklist status, the domain should be treated as a high‑confidence phishing indicator until further evidence suggests otherwise.