robinhood[.]gate-cryptolist[.]com

Analysis of robinhood.gate-cryptolist.com shows a newly created domain that is actively used for generic phishing campaigns. The domain was registered on June 17, 2024 through Key-Systems GmbH and is hosted on the IP address 188.114.97.3, which is served by Cloudflare as indicated by its authoritative nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. VirusTotal scans have returned 14 positive detections out of 91 security vendors, confirming that multiple anti‑malware engines consider the domain malicious.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing infrastructure. Current threat intelligence assigns an elevated risk level and marks the domain as active, suggesting ongoing use in credential‑stealing operations. No additional public evidence such as SSL certificate details, HTTP response codes, page title, or safe‑browsing verdicts is available at this time, leaving the surface‑web characteristics of the site unverified.

Defenders should therefore block network traffic to 188.114.97.3 and to the domain name itself, add the domain to internal blocklists, and monitor for any outbound connections from internal hosts to the Cloudflare edge nodes serving this address. Continuous re‑evaluation is advised, as further analysis of the web payload or associated command‑and‑control activity may reveal additional indicators of compromise.