beth[.]ai-cryptolist[.]net

The domain beth.ai-cryptolist.net was created on November 5 2025 and registered through Key-Systems GmbH. Authoritative name servers listed are melissa.ns.cloudflare.com and miles.ns.cloudflare.com, confirming that DNS resolution is provided by Cloudflare. The domain resolves to IP address 172.67.198.248, an address that belongs to Cloudflare's globally distributed edge network, a hosting arrangement frequently abused by threat actors to obscure the true location of malicious infrastructure.

VirusTotal analysis shows that 18 of 91 security vendors have flagged the domain as malicious, indicating a measurable consensus among scanning engines that the site is associated with phishing activity. The domain is present on one external blocklist and has been explicitly blocked by the PhishDestroy mitigation service, providing concrete evidence that at least one anti‑phishing platform has taken active steps to prevent traffic to the site. No additional intelligence such as page title, SSL certificate details, HTTP status codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) references are currently available, leaving those vectors unverified.

This lack of public-facing metadata, combined with the recent registration date, Cloudflare DNS usage, and the observed detection count, points to a typical generic phishing operation that likely leverages the domain to host credential‑stealing pages or lure victims via email or messaging campaigns. Defenders should immediately add beth.ai-cryptolist.net to URL filtering and DNS blocklists, monitor for connections to 172.67.198.248, and incorporate the domain into internal indicator‑of‑compromise (IOC) feeds. Ongoing re‑scanning with VirusTotal and periodic checks of Safe Browsing and OTX are recommended to capture any evolution in the domain's threat profile or the emergence of additional supporting infrastructure.