shih-tzu-2[.]gate-cryptolist[.]com

shih-tzu-2.gate-cryptolist.com is currently listed as an active generic phishing infrastructure with an elevated risk rating. The domain was registered on 17 June 2024 through Key-Systems GmbH and is served by the Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is the sole host observed for this indicator. The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy filtering service.

VirusTotal analysis shows that 13 of 91 scanned security vendors flag the domain as malicious, confirming a consensus of suspicion among a subset of scanners. No additional contextual data such as page title, SSL certificate details, or HTTP response codes are available in the current intelligence set, leaving the exact phishing payload and targeted brand undefined. The limited visibility means that while the domain’s infrastructure and partial vendor detections are sufficient to warrant immediate mitigation, the precise attack vector cannot be fully characterized at this time. Defenders should add the domain and its resolving IP address to network deny lists, enforce DNS sink‑hole rules for the associated Cloudflare nameservers, and monitor outbound traffic for connections to 188.114.97.3.

Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds are recommended to capture any evolution in detection rates. Organizations using phishing‑resistant authentication should be reminded to verify credential entry endpoints, especially for services that may be impersonated by this infrastructure. Given the active status and elevated risk, proactive blocking is advised pending further forensic analysis.