one-punch-cat[.]gate-cryptolist[.]com

The domain one-punch-cat.gate-cryptolist.com is currently active and has been identified as a credential‑harvesting platform. Registration data shows it was created on June 17, 2024 through the registrar Key-Systems GmbH. DNS resolution points to the IP address 188.114.97.3 and the domain is served by Cloudflare’s authoritative name servers (dale.ns.cloudflare.com and vera.ns.cloudflare.com).

The IP is listed on a single security blocklist, and the domain is blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has taken action against it. VirusTotal analysis reports 14 detections out of 91 scanned security vendors, confirming that a notable subset of scanners consider the domain malicious. No additional intelligence such as page title, SSL certificate details, or explicit brand impersonation has been published, so the exact visual content and the targeted brand remain unknown.

Defenders should continue to block the domain at DNS and proxy layers, monitor outbound traffic for connections to 188.114.97.3, and add the domain to internal blocklists. Because the domain leverages Cloudflare DNS, any future changes to hosting or sub‑domains may not be reflected in current records; therefore, periodic re‑scanning with VirusTotal and other sandbox services is recommended to capture potential evolution of the threat. Organizations should also educate users about unsolicited login requests and encourage verification of URLs before credential entry, as the domain’s primary intent appears to be harvesting usernames and passwords.