first-bitcoin-kid[.]gate-cryptolist[.]com

first-bitcoin-kid.gate-cryptolist.com is currently active and has been identified as a generic phishing vector. The domain was registered on 17 June 2024 through the registrar Key‑Systems GmbH and is hosted on the IP address 188.114.96.3. DNS resolution uses Cloudflare’s authoritative nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com, indicating the attacker is leveraging Cloudflare’s DNS infrastructure to obscure the true origin of the site. The domain appears on a single public blocklist and has been added to the PhishDestroy feed, confirming that at least one anti‑phishing service has taken remediation action.

VirusTotal analysis shows that 14 of 91 scanned security engines returned a positive detection for the domain, providing independent corroboration of malicious intent. No additional public reputation services or Safe Browsing entries were supplied in the intelligence set. The limited number of detections suggests the site may be newly deployed or using evasion techniques to avoid broader blacklisting. Defenders should immediately add 188.114.96.3 to network‑level deny lists and block any DNS resolution for first‑bitcoin‑kid.gate‑cryptolist.com.

Continuous monitoring of the IP range assigned to the host is advised, as the operator could launch further phishing campaigns from adjacent addresses. Because the domain’s page content and SSL certificate have not been disclosed, analysts should treat any user‑initiated connections as potentially unsafe until a full content inspection is performed. Organizations are encouraged to update email‑filtering rules to flag URLs containing the “gate‑cryptolist.com” suffix and to educate users about unsolicited requests for cryptocurrency credentials, even though the specific brand being spoofed has not been publicly identified.