grok-ai-agent[.]gate-cryptolist[.]com

The domain grok-ai-agent.gate-cryptolist.com was registered on 17 June 2024 through Key-Systems GmbH. Its authoritative nameservers are dale.ns.cloudflare.com and vera.ns.cloudflare.com, indicating that DNS resolution is provided by Cloudflare. The domain resolves to the IPv4 address 188.114.97.3, which is part of Cloudflare’s edge network and therefore masks the underlying hosting provider. Independent analysis by VirusTotal shows that 14 of 91 scanned security vendors have flagged the domain as malicious, providing a moderate consensus of detection. The domain is listed on a single external security blocklist and has been actively blocked by the PhishDestroy filtering service, confirming that at least one operational mitigation system has taken action against it.

No public SSL certificate details, HTTP response codes, or page‑title information have been disclosed, so the surface‑web characteristics of the site remain unverified. The available intelligence classifies the activity as generic phishing, and the risk level is elevated while the operational status is marked as active. The detection count of 14/91 indicates that a subset of reputable scanners have identified malicious behavior, but the majority have not flagged the domain, suggesting that the payload may be transient or that detection signatures are still being propagated. The single blocklist inclusion demonstrates limited exposure in public reputation feeds, which can hinder automated blocking in environments that rely on multiple feeds. Because the domain uses Cloudflare’s DNS service, it benefits from rapid IP changes and built‑in DDoS protection, complicating static IP‑based defenses.

Defenders should prioritize real‑time DNS query monitoring to capture any resolution attempts to this domain, and should consider integrating the domain into threat‑intel platforms that support automated feed ingestion.