palapa[.]next-cryptolist[.]net

Analysis of palapa.next-cryptolist.net shows the domain is actively used for phishing and is classified with an elevated risk level. The domain was created on September 16, 2025 and is registered through Key-Systems GmbH. DNS resolution points to the IPv4 address 172.67.181.166 and is served by Cloudflare name servers hunts.ns.cloudflare.com and nena.ns.cloudflare.com.

Threat intelligence sources place the domain on a single security blocklist and it is explicitly listed as blocked by the PhishDestroy service. VirusTotal scanning recorded 17 detections out of 91 security vendors, confirming that multiple antivirus and URL‑filtering engines have identified malicious activity associated with the host. No additional public indicators such as SSL certificate details, HTTP response codes, page title, or brand targeting are presently available, limiting the granularity of the technical profile.

Defenders should immediately add palapa.next-cryptolist.net to outbound and inbound filtering rules, enforce DNS sinkholing where possible, and monitor for any traffic to the associated IP address 172.67.181.166. Continuous re‑scanning of the domain through multi‑vendor services is advised to capture any changes in detection posture. Organizations using the PhishDestroy blocklist can rely on its existing block, but broader security platforms should be updated to reflect the confirmed phishing status to reduce exposure.