neptune-cash[.]gate-cryptolist[.]com

Analysis of neptune-cash.gate-cryptolist.com shows an active infrastructure supporting a generic phishing operation. The domain was registered on June 17, 2024 through Key-Systems GmbH and is hosted on the IP address 188.114.97.3, which is served by Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. VirusTotal records indicate that 14 of 91 security vendors have flagged the domain, demonstrating a moderate level of detection across the threat‑intelligence community.

The domain is listed on one external blocklist and has been explicitly blocked by the PhishDestroy service, confirming its malicious classification by at least one dedicated anti‑phishing platform. No additional public indicators such as SSL certificates, HTTP response codes, or page titles are currently available, limiting the depth of content‑level analysis. The observable data points—registration date, hosting details, vendor detections, and blocklist presence—provide sufficient confidence to treat the domain as a high‑confidence phishing indicator.

Defenders should add the domain and its resolving IP to outbound and inbound deny lists, monitor DNS queries for the associated Cloudflare nameservers, and ensure that any email or web filtering solutions incorporate the current blocklist entries. Continuous re‑evaluation is advised, as further evidence such as payload samples or victim reports may emerge, refining the threat profile and informing response actions.