aintivirus-2[.]entry-cryptolist[.]app

PhishDestroy has flagged aintivirus-2.entry-cryptolist.app as an active crypto drainer phishing domain designed to trick users into connecting cryptocurrency wallets under the false pretense of security scanning or antivirus services. This domain mimics legitimate antivirus platforms to deceive users into approving malicious wallet connections, resulting in direct fund drainage. The infrastructure leverages a Google Trust Services SSL certificate to appear credible, while resolving to IP address 188.114.97.3, a known phishing hosting provider. Threat intelligence confirms this domain is currently undetected by 95 antivirus engines on VirusTotal, presenting a high-risk window for exploitation. This domain, registered under a privacy-protected registrar, shows minimal age and no prior reputation, enabling attackers to operate undetected. Current data indicates 0 detections across all major scanning platforms, with no listings on blocklists such as PhishTank, OpenPhish, or URLVoid. The SSL certificate issued by Google Trust Services adds a veneer of legitimacy, but the domain’s structure and naming pattern — entry-cryptolist.app — are clear indicators of a coordinated crypto drainer campaign. The domain resolves to a bulletproof hosting infrastructure commonly used by cybercriminals to evade takedowns. Users who visited aintivirus-2.entry-cryptolist.app or connected their wallets via this domain are strongly advised to immediately revoke any wallet approvals through their wallet interface or blockchain explorer. Disconnect the domain from your wallet settings and scan your device for malware using a reputable antivirus tool. Report the domain to your wallet provider and consider transferring funds to a new, secure wallet if any unauthorized transactions occurred. Enable multi-factor authentication on all crypto accounts and avoid clicking links from unsolicited messages.