based-turbo[.]gate-cryptolist[.]com

The domain based-turbo.gate-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and is currently hosted on the IP address 188.114.96.3. DNS resolution is served by the Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and possibly its CDN or proxy services. VirusTotal analysis shows that 14 of 91 security vendors flagged the domain, reflecting a moderate level of detection across the threat‑intelligence community.

The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as malicious. The risk level is marked as elevated and the status is active, suggesting ongoing use in a phishing campaign. No public page title or SSL certificate details are available in the current intelligence set, and the specific phishing lure or targeted brand has not been disclosed, leaving the exact social‑engineering vector uncertain.

Defenders should add the domain and its resolved IP address to deny‑list rules across perimeter firewalls, DNS filtering, and endpoint protection platforms. Continuous monitoring of Cloudflare‑associated IP ranges for anomalous traffic patterns is advised, as the infrastructure could be leveraged for additional malicious domains. Integration of the domain’s hash into threat‑intel feeds will ensure broader community awareness, and periodic re‑scans with VirusTotal or similar services are recommended to capture any changes in vendor detection scores.