diamond-hands-3[.]ai-cryptolist[.]net

Analysis of diamond-hands-3.ai-cryptolist.net indicates a high‑risk generic phishing infrastructure that is actively serving a crypto‑drainer campaign. The domain was registered on 11 April 2026 through Key‑Systems GmbH and is hosted behind Cloudflare (nameservers melissa.ns.cloudflare.com, miles.ns.cloudflare.com) resolving to 172.67.198.248, which is geolocated to Canada. The TLS certificate is issued by Google Trust Services under the WE1 authority, confirming a valid HTTPS endpoint despite the HTTP 403 response observed during probing. The site presents the page title “Just a moment…”, but no further content has been captured, leaving the exact payload unknown. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records 17 detections out of 94 scanning engines, corroborating malicious intent. The domain appears on a single security blocklist and is already listed by PhishDestroy as a confirmed crypto‑drainer. Given the active status, high risk rating, and confirmed detection count, defenders should immediately block DNS resolution and HTTP/S traffic to this host, incorporate the IP address 172.67.198.248 into network‑level deny lists, and ensure that any email filters flag URLs containing the domain. Continued monitoring of Cloudflare edge IP ranges for similar patterns is advised, as the attacker may pivot to additional domains sharing the same infrastructure. Until further forensic evidence is obtained, the domain should be treated as a malicious actor under investigation.