This domain, genesis-tools.cc, was registered on July 30, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted on the IP address 188.114.97.3. The authoritative nameservers are lady.ns.cloudflare.com and weston.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The domain is listed as active in threat intelligence feeds and appears on one security blocklist. PhishDestroy has confirmed the domain is blocked, and three of ninety‑one VirusTotal scanners have flagged it as malicious, reflecting a modest but non‑trivial detection rate.
No additional public blocklists, Safe Browsing entries, or Open Threat Exchange (OTX) mentions were observed in the available data. The domain’s creation date coincides with the report date, suggesting a rapid deployment. SSL/TLS information, HTTP response codes, and page title have not been disclosed, and no evidence links have been provided. Defenders should incorporate the IP address 188.114.97.3 and the domain name into their ingress and egress filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and ensure that any outbound connections to this destination are blocked.
Continuous re‑evaluation of VirusTotal and other sandbox detections is recommended, as additional scanners may flag the domain as analysis progresses. Organizations using automated phishing protection should add genesis-tools.cc to their blacklist and verify that existing email and web gateway solutions are configured to block content from the identified IP and registrar. Given the limited detection footprint, heightened vigilance is advised to mitigate potential credential harvesting attempts that may arise from this newly active infrastructure.