modalai[.]gate-cryptolist[.]com

On July 29, 2026, the domain modalai.gate-cryptolist.com was observed as an active generic phishing infrastructure. VirusTotal records indicate that 14 of 91 scanning engines have flagged the domain, demonstrating a moderate level of detection across the security community. The domain resolves to the IPv4 address 188.114.96.3, which is currently listed on a single external blocklist and has been explicitly blocked by the PhishDestroy service. The authoritative name server information could not be retrieved (NS_NOT_FOUND), limiting immediate insight into registration details and potential ownership patterns.

The presence on a blocklist and multiple vendor detections suggest that the domain is being used to host malicious content, but the limited number of blocklist entries and the absence of publicly disclosed SSL certificate or HTTP response data leave uncertainties regarding the full scope of the campaign, such as the specific landing page content, targeted brands, or the duration of hosting. Defenders should prioritize adding 188.114.96.3 to network‑level deny lists and ensure that any outbound connections to modalai.gate-cryptolist.com are blocked at perimeter devices. Email security gateways should be updated to quarantine messages containing URLs or references to this domain, and endpoint protection solutions should be configured to flag any processes that attempt to contact the IP address.

Continuous monitoring of VirusTotal and blocklist updates is recommended to detect any changes in detection rates or additional listings that could indicate escalation. Because the registrar and registration timestamps are not disclosed, threat‑intel teams may consider performing WHOIS lookups and passive DNS monitoring to gather additional infrastructure context. Until further forensic evidence is available, treating the domain as hostile and restricting all traffic to it is the prudent mitigation approach.