et-ass-pussy[.]next-cryptolist[.]net

Analysis of et-ass-pussy.next-cryptolist.net shows an active infrastructure supporting a generic phishing campaign with an elevated risk rating. The domain was registered through Key-Systems GmbH and first observed on September 16, 2025. DNS resolution points to the IP address 172.67.181.166, which belongs to Cloudflare's network, and the authoritative name servers are hunts.ns.cloudflare.com and nena.ns.cloudflare.com, confirming Cloudflare hosting.

VirusTotal scans indicate that 17 out of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, demonstrating a moderate consensus among security vendors. Independent threat intel confirms that the domain is listed on at least one public blocklist and is actively blocked by the PhishDestroy repository, reinforcing the credibility of the detection. No additional data such as SSL certificate details, HTTP response codes, or page titles have been disclosed, leaving the exact phishing payload and targeted brand unverified.

Defenders should prioritize immediate containment: add the domain to DNS sinkhole lists, block outbound connections to its IP address, and incorporate the domain into IDS/IPS signatures. Continuous monitoring of traffic to Cloudflare edge nodes for anomalous requests is advised, as is periodic re‑evaluation of vendor detection scores to capture any changes in classification. Organizations should also educate users about unsolicited communications that might reference the domain, given its recent creation date and rapid adoption by threat actors.