alptrustgptki[.]com

This domain, alptrustgptki.com, is actively impersonating an artificial intelligence-driven cryptocurrency trading platform, a tactic consistent with crypto drainer distribution. Analysis of the page title, 'Alptrust GPT – KI-gestützte Krypto-Trading-Plattform,' indicates an attempt to deceive users into believing the site offers legitimate AI-powered trading tools, while the underlying objective is to deploy malicious scripts designed to siphon cryptocurrency from connected wallets. No explicit brand impersonation is evident, but the use of 'GPT' in the domain name and page title leverages the reputation of established AI technologies to lend credibility to the fraudulent operation. The domain exhibits characteristics of a crypto drainer kit, likely targeting users of decentralized finance (DeFi) platforms and self-custody wallets through social engineering and malicious smart contract interactions. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain is flagged by 13 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it under 'SOCIAL_ENGINEERING.' It is registered through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to the IP address 104.21.9.164, a Cloudflare-protected endpoint. The domain was created on June 02, 2026, an anomalous future date suggesting potential domain age manipulation or a registration error, which is a common tactic to evade detection. The site employs HTTP/3 and HSTS, likely to mimic legitimate security practices, while its SSL certificate is issued by Google Trust Services. The domain appears on four security blocklists and is actively blocked by multiple wallet security tools, including MetaMask and PhishDestroy. Current status indicates the domain remains active and operational, posing a high risk to users. Response actions by security vendors and blocklist providers have mitigated exposure, but the infrastructure remains intact, and the threat persists. The use of Cloudflare complicates takedown efforts, while the anomalous creation date may indicate an attempt to bypass heuristic-based detection systems. Users are advised to treat this domain as highly malicious and avoid interaction entirely. Wallet holders should revoke any smart contract approvals associated with this domain and monitor connected accounts for unauthorized transactions. Organizations are encouraged to update internal blocklists and educate users on recognizing AI-themed crypto scams, particularly those leveraging reputable technology names to establish false legitimacy.