mansory[.]ai-cryptolist[.]org

This domain, mansory.ai-cryptolist.org, is actively flagged as a high-risk phishing site targeting cryptocurrency users. Registered on April 11, 2026, through Key-Systems GmbH, the domain currently resolves to 188.114.96.3, an IP address geolocated to Canada and associated with CloudFlare, Inc. infrastructure. Analysis indicates the domain is still operational, though it returns an HTTP 403 status, suggesting access restrictions or a placeholder state. The nameservers, abdullah.ns.cloudflare.com and harlee.ns.cloudflare.com, further confirm CloudFlare as the hosting provider, a common tactic to obscure the true origin of malicious traffic. Security vendors have detected this domain with notable consistency. As of July 12, 2026, 17 out of 95 security engines on VirusTotal classify the domain as malicious, reinforcing its classification as a phishing threat. The domain appears on at least one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft, indicating no legitimate use. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing sites frequently leverage valid certificates to appear legitimate. The specific phishing theme remains unconfirmed, but the inclusion of 'cryptolist' in the subdomain suggests a focus on cryptocurrency-related fraud, such as fake wallet services, token giveaways, or credential harvesting. Defenders should treat this domain as hostile and prioritize blocking it at the DNS and network levels. Organizations should also monitor for any internal traffic to this domain, as it may indicate compromised credentials or ongoing phishing attempts. Given its active status and consistent detection across security platforms, this domain poses a credible threat to users and should be mitigated accordingly.