bnboflegends[.]next-cryptolist[.]net

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed to harvest cryptocurrency wallet credentials. Analysis indicates the infrastructure mimics legitimate crypto wallet login portals, tricking users into submitting sensitive authentication details such as private keys or recovery phrases. The threat type aligns with credential theft campaigns targeting decentralized finance (DeFi) and blockchain asset holders, a growing vector for financial fraud. Infrastructure analysis reveals the domain bnboflegends.next-cryptolist.net resolves to the IP address 104.21.64.107 and was registered through Key-Systems GmbH on April 11, 2026, an unusually forward-dated registration suggesting potential obfuscation. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy. Detection metrics show 19 out of 95 security vendors on VirusTotal flag the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist, specifically PhishDestroy, and is currently offline, though this status may change. Mitigation against this threat requires immediate action from both end users and network administrators. Users should verify domain authenticity before entering credentials, particularly for crypto wallets, by cross-referencing official sources and checking for subtle misspellings or irregular subdomains. Network-level protections should include blocking the domain and its resolving IP (104.21.64.107) at firewalls and DNS filters. Organizations should monitor for internal access attempts to this domain and conduct retrospective analysis of logs for prior connections. Given the elevated risk, users who may have interacted with the domain should revoke active sessions, rotate credentials, and audit wallet transactions for unauthorized activity.