agent-krasnov[.]ai-cryptolist[.]org

The domain agent-krasnov.ai-cryptolist.org is currently active and classified as a high‑risk generic phishing site. Registration occurred on 2025‑11‑05 through Key-Systems GmbH, and the authoritative nameservers are abdullah.ns.cloudflare.com and harlee.ns.cloudflare.com. DNS resolution points to the Cloudflare‑hosted address 188.114.96.3, which is geolocated to Canada. HTTP requests receive a 302 redirect, and the TLS certificate is issued by Google Trust Services under the WE1 label. The page title returned by the server is "Just a moment...". Threat intelligence indicates the site employs a Seed Phrase Phishing kit and is associated with an investment‑scam narrative. The domain is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal analysis shows 13 of 94 security vendors flag the domain, and Gridinsoft assigns a trust score of 0/100. Defenders should add the domain, its IP address, and the associated nameservers to deny‑list rules, monitor for any related C2 traffic, and consider sink‑holing the IP to capture future payloads. Ongoing observation is required, as the exact content of the hosted page has not been publicly disclosed beyond the title, leaving the full scope of the phishing payload uncertain.