rockytherock[.]gate-cryptolist[.]com

The domain rockytherock.gate-cryptolist.com is currently active and has been classified as a generic phishing threat with an elevated risk rating. Infrastructure analysis shows the domain was registered on June 17, 2024 through Key-Systems GmbH and resolves to the IPv4 address 188.114.97.3. DNS resolution is delegated to Cloudflare’s authoritative nameservers dale.ns.cloudflare.com and vera.ns.cloudflare.com, indicating that the operator is leveraging Cloudflare’s CDN and protection services to obscure the true hosting environment. VirusTotal reports that 14 of 91 security vendors have flagged the domain, suggesting a moderate level of detection across commercial scanners. The domain is also listed on a single security blocklist and has been specifically blocked by the PhishDestroy service, providing additional confirmation of malicious intent.

Publicly available evidence does not include a page title, SSL certificate details, HTTP response codes, or any observed branding in the page content, leaving the exact impersonated target undefined. Consequently, defenders lack concrete indicators of the specific brand or service being spoofed, and the phishing kit or payload remains unverified. The absence of these data points should be noted as uncertainty in the overall threat profile.

Mitigation guidance recommends that network defenders immediately add rockytherock.gate-cryptolist.com to DNS blocklists and firewalls, enforce outbound filtering to the IP address 188.114.97.3, and monitor for any related traffic patterns. Organizations should also consider leveraging threat‑intelligence feeds that include the domain’s detection count and blocklist status to automate protective actions. Continuous re‑evaluation is advised, as future scans may reveal additional indicators such as SSL fingerprints or page content that could refine detection rules.