dont-cash[.]gate-cryptolist[.]com

The domain dont-cash.gate-cryptolist.com was registered on June 17, 2024 through Key-Systems GmbH and is serviced by the Cloudflare authoritative nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. DNS resolution returns the address 188.114.97.3, an IP range associated with Cloudflare’s edge network, indicating the operator is leveraging a widely used CDN to hide the true hosting location. Threat intelligence sources have placed the domain on a single security blocklist, and it is explicitly listed as blocked by the PhishDestroy feed.

VirusTotal analysis shows that 15 of 91 scanned security vendors flag the domain as malicious, reinforcing the suspicion of malicious activity despite the modest blocklist footprint. No publicly available page title, SSL certificate details, or HTTP response codes have been captured, leaving the surface‑level content and exact phishing vector unverified. Consequently, defenders lack concrete evidence of the specific lures or credential‑stealing mechanisms employed.

Given the corroborating evidence—registrar information, Cloudflare infrastructure, blocklist inclusion, and multi‑vendor detection—security teams should treat the domain as high‑risk. Recommended actions include adding the domain to URL filtering policies, monitoring DNS queries for related subdomains, and updating intrusion detection signatures to flag traffic to 188.114.97.3. Continuous observation of VirusTotal and other threat feeds is advised to capture any emerging indicators such as sample payloads, additional blocklist listings, or changes in detection consensus.