sprout[.]gate-cryptolist[.]com

sprout.gate-cryptolist.com is a newly observed domain that has been associated with a generic phishing operation. The domain was registered on June 17, 2024 through the German registrar Key-Systems GmbH. It is hosted on the IP address 188.114.96.3 and uses Cloudflare’s authoritative name servers dale.ns.cloudflare.com and vera.ns.cloudflare.com. Reputation data show that the domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that at least one anti-phishing feed has flagged the domain as malicious.

VirusTotal analysis reports that 13 of 91 scanned security vendors have flagged the domain, providing additional corroboration of its malicious nature. No further technical details such as SSL certificate attributes, HTTP response codes, or page title have been disclosed, and the content of the site has not been publicly examined. Consequently, the precise phishing lure, target brand, or credential‑harvesting mechanism remains unknown.

The available evidence points to an operational phishing infrastructure that is already being used by threat actors, and the elevated risk rating reflects the combination of active blocking, multiple vendor detections, and the use of a reputable hosting provider to obscure the true origin. Defenders should add 188.114.96.3 and sprout.gate-cryptolist.com to network‑level deny lists, monitor DNS queries for the domain and its Cloudflare name servers, and consider sinkholing or redirecting traffic to a safe landing page. Ongoing observation of VirusTotal and other threat‑intel feeds is recommended to capture any new detections or changes in the domain’s hosting posture.