dnai16z[.]gate-cryptolist[.]com

The domain dnai16z.gate-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and is currently resolving to the IPv4 address 188.114.96.3. Both authoritative name servers are hosted by Cloudflare (dale.ns.cloudflare.com and vera.ns.cloudflare.com). An HTTP request to the host returns a 200 OK status, indicating that a web service is actively responding. The site has been flagged by VirusTotal, where 14 of 91 scanned security vendors raised detections, suggesting the presence of malicious components or behavior.

Independent blocklist monitoring shows the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one threat‑intelligence source classifies the infrastructure as hostile. No additional metadata such as SSL certificate details, page title, or brand targeting is available from the current evidence set, so the precise visual appearance and the exact victim brand being spoofed remain unverified. The overall risk rating is high and the domain status is marked as active, meaning the infrastructure continues to be reachable and capable of delivering phishing payloads.

Defenders should add the domain and its associated IP address to outbound and inbound blocklists, enforce DNS sinkholing where possible, and monitor for any related C2 traffic. Security teams are advised to update URL filtering rules in web proxies and email gateways to include the host, and to watch for any future detections that may surface additional indicators such as page titles or credential‑stealing forms. Continuous re‑evaluation is recommended, as threat actors may modify the site or reuse the infrastructure for other campaigns.