tokabu[.]gate-cryptolist[.]com

Analysis of tokabu.gate-cryptolist.com indicates that the domain is actively used for phishing operations. The domain was registered on June 17, 2024 through Key-Systems GmbH and is currently delegated to the Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is hosted on a Cloudflare network and therefore benefits from the provider's global anycast infrastructure. The domain appears on a single security blocklist and has been specifically blocked by the PhishDestroy feed, confirming its inclusion in known phishing mitigation sources.

VirusTotal scans show that 14 out of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion of malicious intent despite the majority of scanners returning a clean result. No public page title or content snapshot is available in the current intelligence set, so the exact landing page layout and targeted brand remain unverified. Defenders should add tokabu.gate-cryptolist.com to local DNS blocklists, update firewall deny lists, and consider sinkholing the associated IP address to disrupt traffic.

Continuous monitoring of the IP 188.114.97.3 for additional malicious payloads or new subdomains is advised, as Cloudflare-hosted infrastructure can be leveraged for rapid rehosting. Organizations employing email filters should ensure that URLs matching this domain are treated as high‑confidence phishing indicators, and incident response teams should be prepared to investigate any credential submissions that reference the domain. The combination of recent registration, active blocklist inclusion, and multi‑vendor detection makes tokabu.gate-cryptolist.com a high‑priority indicator for threat‑hunting and mitigation activities.