hy[.]ai-cryptolist[.]com

Analysis indicates that the domain hy.ai-cryptolist.com was registered on April 11, 2026, through Key-Systems GmbH and is currently flagged as a high-risk crypto scam. The domain resolves to the IP address 188.114.96.3, which is associated with Cloudflare, Inc. and located in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com), along with HTTP/3 and a Google Trust Services SSL certificate (WE1). The domain returns an HTTP 403 status, and its page title is recorded as 'Just a moment...', which may suggest an intermediate or blocking page rather than the final malicious content. As of July 12, 2026, the domain remains active and appears on at least one security blocklist. Detection engines on VirusTotal report 18 of 94 vendors flagging the domain as malicious, though the exact nature of the threat beyond its classification as a crypto scam is not yet fully analyzed. The Gridinsoft trust score of 0/100 further supports its high-risk designation. Defenders should treat this domain as part of an active phishing campaign targeting cryptocurrency users, and consider blocking or monitoring traffic to 188.114.96.3 and its associated Cloudflare infrastructure. Additional investigation into the final payload or redirection chain is recommended, as the current HTTP 403 response may indicate evasion tactics or incomplete deployment.