influxai-token[.]gate-cryptolist[.]com

Analysis of the domain influxai-token.gate-cryptolist.com indicates active malicious infrastructure targeting credential harvesting. The domain was registered on 17 June 2024 through Key-Systems GmbH and is hosted on Cloudflare infrastructure, as evidenced by the authoritative name servers dale.ns.cloudflare.com and vera.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is currently listed on one public security blocklist. VirusTotal reports that 12 of 91 scanning engines flag the domain, reinforcing the suspicion of malicious intent.

The domain is also listed as blocked by the PhishDestroy repository, and the risk level has been assigned as elevated. No public page title, SSL certificate details, or HTTP response codes are available in the current intelligence set, leaving the exact payload and lure technique unconfirmed. The lack of a documented page title or brand target suggests that the site may be used as a generic credential‑stealing gateway rather than a brand‑specific clone, but this cannot be verified without live analysis. Defenders should treat influxai-token.gate-cryptolist.com as hostile.

Recommended actions include adding the domain and its resolved IP 188.114.97.3 to DNS and proxy blocklists, monitoring outbound traffic for connections to the IP, and enforcing email security controls to prevent users from clicking links that resolve to this host. Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any evolving payloads. Organizations should also consider sharing any observed indicators of compromise with threat‑sharing communities to improve collective detection.