type-shit[.]ai-cryptolist[.]org

Analysis indicates that type-shit.ai-cryptolist.org is an active phishing domain targeting cryptocurrency users through a seed phrase credential harvesting scheme. The domain was registered on April 11, 2026, via Key-Systems GmbH and currently resolves to 188.114.97.3, an IP address geolocated in Canada and associated with Cloudflare infrastructure. Nameservers abdullah.ns.cloudflare.com and harlee.ns.cloudflare.com further confirm Cloudflare hosting, a common tactic to obscure origin and evade takedowns. The site presents an HTTP 302 redirect with a page title 'Just a moment...', consistent with Cloudflare interstitial pages or proxy behavior, though the final landing page content remains unanalyzed. Infrastructure reveals the use of Google Trust Services SSL certificate (WE1) and HTTP/3 protocol, suggesting recent deployment. The domain is classified as a seed phrase phishing kit, a method designed to trick users into submitting cryptocurrency wallet recovery phrases. As of July 14, 2026, the domain remains active and has been flagged by 17 of 94 security vendors on VirusTotal, with a trust score of 0/100 from Gridinsoft. It appears on at least one security blocklist, specifically PhishDestroy. No brand impersonation is confirmed in available data, though the domain name structure ('ai-cryptolist') implies a cryptocurrency or AI-themed lure. Defenders should treat this domain as high-risk. The use of Cloudflare, recent registration, and seed phrase phishing classification warrant immediate blocking at the DNS or network level. Further analysis of the redirect chain and final phishing page is recommended to identify specific wallet targets or social engineering techniques. No evidence suggests this domain is safe for user interaction.