bold-3[.]ai-cryptolist[.]net

Analysis of bold-3.ai-cryptolist.net indicates an active phishing infrastructure. The domain was registered on 5 November 2025 through Key-Systems GmbH and is served by Cloudflare nameservers melissa.ns.cloudflare.com and miles.ns.cloudflare.com. DNS resolution points to the address 104.21.68.219, a Cloudflare‑managed IP range commonly leveraged for malicious hosting. The domain is currently listed on one security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that threat‑intelligence platforms consider it malicious.

VirusTotal scans show that 18 of 91 antivirus and URL‑reputation engines flag the domain, reinforcing the suspicion of malicious activity. No public SSL certificate details or HTTP response codes are available in the supplied data, and the page title or content has not been disclosed, leaving the exact phishing lure unknown. Defenders should treat any traffic to bold-3.ai-cryptolist.net as hostile, enforce blocklists at the network perimeter, and consider sink‑holing or DNS‑sink‑blocking for the associated IP.

Continuous monitoring of the domain’s DNS records and the hosting IP for changes is advised, as Cloudflare‑based infrastructure can be rapidly repurposed. Organizations should also update endpoint protection signatures to include the observed VirusTotal detections and ensure that email gateways flag any messages containing links to this domain. The limited visibility of the payload underscores the need for proactive defensive controls rather than reliance on content analysis alone.