corionplatform[.]gate-cryptolist[.]com

Analysis of corionplatform.gate-cryptolist.com shows an active generic phishing infrastructure that was registered on June 17, 2024 through Key-Systems GmbH. The domain resolves to the IPv4 address 188.114.97.3 and is served by Cloudflare nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com. HTTP requests to the host return a 200 OK status, indicating that the site is currently reachable. The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that threat‑intelligence communities have identified it as malicious.

VirusTotal scans report that 12 of 91 antivirus and URL‑reputation engines flag the domain, providing independent corroboration of its malicious nature. No additional public threat‑intel sources such as OTX or Safe Browsing entries are referenced in the available data. The combination of a recent registration, active hosting, positive detections across multiple vendors, and inclusion on a blocklist suggests a deliberate phishing campaign. However, the specific brand or service being spoofed remains undetermined because the page title and any visual cues have not been disclosed.

Defenders should block traffic to 188.114.97.3 and add corionplatform.gate-cryptolist.com to local deny lists. Monitoring of DNS queries for the domain and its associated Cloudflare nameservers is recommended to detect any future resolution attempts. Organizations using URL filtering should ensure the domain is covered by existing phishing filters, and incident response teams should treat any credential submissions to this site as compromised. Continuous re‑evaluation is advised as additional intelligence, such as page content or victim reports, becomes available.