dogecast-bsc[.]next-cryptolist[.]net

The domain dogecast-bsc.next-cryptolist.net was registered on 16 September 2025 through Key-Systems GmbH and is currently hosted on Cloudflare infrastructure, as indicated by its authoritative nameservers hunts.ns.cloudflare.com and nena.ns.cloudflare.com. DNS resolution points to the IP address 104.21.64.107, which is part of Cloudflare's edge network and does not reveal a dedicated backend server. The domain appears on a single security blocklist and has been actively listed by the PhishDestroy feed, confirming that it is being used in malicious campaigns. VirusTotal scans show that 18 of 91 security vendors have flagged the domain, providing independent corroboration of its malicious status.

No additional public reputation services such as Google Safe Browsing, Open Threat Exchange, or SSL/TLS trust scores are supplied in the current intelligence set, and the HTTP response code, page title, or content snapshot have not been captured, leaving the exact phishing lure undefined. Analysis indicates that the primary risk vector is credential harvesting, consistent with the generic phishing classification. The presence of Cloudflare nameservers suggests the operators are leveraging the provider’s CDN and DDoS mitigation to hide origin infrastructure, a common tactic for phishing operators. Defenders should add the domain and its resolving IP address to deny‑list rules in firewalls, proxy filters, and DNS security solutions.

Monitoring for DNS queries to the domain and for outbound connections to the IP 104.21.64.107 can help detect compromised hosts attempting to exfiltrate credentials. Because the content has not been harvested, security teams should request a live scrape from a sandbox environment to verify the page’s behavior and to extract any embedded malicious payloads or credential‑stealing forms. Continuous re‑evaluation is recommended, as the domain may evolve its tactics or expand its hosting footprint.