built-different[.]ai-cryptolist[.]net

The domain built-different.ai-cryptolist.net was registered on April 11, 2026 through Key-Systems GmbH and is currently resolved to the Cloudflare front‑end IP 104.21.68.219, which is geolocated to Canada. The authoritative nameservers are melissa.ns.cloudflare.com and miles.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and DDoS protection services. HTTP requests return a 302 redirect and the page title observed is "Just a moment...", a generic placeholder that provides no insight into the final landing content. The site presents a SSL certificate issued by Google Trust Services under the WE1 domain, confirming that TLS termination is handled by Cloudflare. Technical fingerprints include Cloudflare and HTTP/3 support. Security telemetry shows the domain is classified as a Crypto Scam, specifically employing a Seed Phrase Phishing kit. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist. It has been blocked by PhishDestroy, and 18 of 94 VirusTotal scanners flag it as malicious. The risk rating is high and the status remains active. While the exact phishing payload and targeted cryptocurrency platform are not yet disclosed, the combination of a low trust score, presence on blocklists, and the use of a seed‑phrase phishing kit strongly suggests attempts to harvest private keys or recovery phrases from victims. Defenders should add the domain to DNS and URL filtering policies, monitor outbound connections to the associated Cloudflare IP, and consider sinkholing or sandboxing any observed redirects. Continuous re‑evaluation is advised as further content may be revealed behind the initial redirect.