solbox[.]gate-cryptolist[.]com

The domain solbox.gate-cryptolist.com was registered on June 17, 2024 through the Key-Systems GmbH registrar and is currently resolving to the IP address 188.114.96.3. Both authoritative name servers, dale.ns.cloudflare.com and vera.ns.cloudflare.com, are hosted by Cloudflare, indicating the use of a widely available DNS service that can obscure the true hosting location. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, suggesting that at least one reputable anti‑phishing organization has observed malicious activity associated with this host. VirusTotal analysis shows that 14 of 91 scanned security vendors flagged the domain, confirming that multiple detection engines consider it suspicious or malicious.

No public page title, SSL certificate details, or HTTP response codes have been disclosed, so the exact content served by the site remains unverified. Consequently, the precise phishing campaign vector—such as credential harvesting, malicious download, or credential‑stealing login page—cannot be confirmed at this time. Nonetheless, the convergence of registrar information, Cloudflare DNS usage, blocklist presence, and multi‑vendor detections provides a strong indication of an active phishing infrastructure.

Defenders should add 188.114.96.3 to network‑level block lists, enforce DNS filtering for solbox.gate-cryptolist.com, and monitor outbound connections to Cloudflare‑resolved domains that lack a clear business purpose. Continuous re‑scanning with VirusTotal and other sandbox services is recommended to capture any evolving payloads or page changes. Organizations that employ email security gateways should also ensure that messages containing links to this domain are quarantined or rejected, given the elevated risk rating and the evidence of active abuse.