common[.]gate-cryptolist[.]com

This domain, common.gate-cryptolist.com, was registered through Key-Systems GmbH on June 17 2024 and remains active as of the report date (July 29 2026). DNS resolution points to the IP address 188.114.96.3 and the domain is hosted on Cloudflare infrastructure, as indicated by the authoritative nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. An HTTP GET request returns status code 200, confirming that a web service is currently reachable. Malware intelligence aggregators have identified the domain on a single security blocklist; it is listed by PhishDestroy, which contributes to its high‑risk rating.

VirusTotal analysis shows that 15 of 91 security vendors classify the domain as malicious, providing independent corroboration of the phishing designation. No additional public reputation scores or SSL certificate details are available in the supplied data set. The limited visibility suggests that the adversary may be relying on the domain’s short registration age and Cloudflare’s protective layer to evade rapid takedown. Defenders should immediately add 188.114.96.3 to network‑level deny lists, enforce DNS‑level blocking of the domain, and monitor outbound traffic for connections to the listed nameservers.

Continuous re‑query of VirusTotal and other sandbox services is advised to capture any evolution in the payload or hosting. Because the site returns a valid HTTP response, users who encounter the URL may be tempted to interact; user‑education campaigns that highlight the recent creation date and the presence on PhishDestroy can reduce successful credential harvesting. Threat‑intel teams should also consider sinkholing the IP address if operationally feasible and share indicators of compromise with peer organizations to broaden the defensive perimeter.