jelly-ai-agent[.]ai-cryptolist[.]net

This domain, jelly-ai-agent.ai-cryptolist.net, is identified as a crypto-focused phishing infrastructure designed to deceive users into disclosing wallet credentials or authorizing fraudulent transactions. Analysis of the domain name and associated content suggests it mimics artificial intelligence or cryptocurrency listing services, likely leveraging social engineering tactics to exploit users seeking AI-driven crypto tools. No direct brand impersonation is confirmed, but the naming convention aligns with known crypto drainer or fake exchange schemes observed in recent campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to the IP address 172.67.198.248. VirusTotal detections show 17 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services, a common feature in phishing domains to appear legitimate. The page title, 'Just a moment...,' is consistent with intermediate redirect or cloaking techniques used to evade detection before loading malicious content. As of the latest assessment, jelly-ai-agent.ai-cryptolist.net has been taken offline, reducing immediate exposure. However, the domain remains registered and could be reactivated or repurposed for future attacks. Users who interacted with this domain should revoke any wallet authorizations, monitor for unauthorized transactions, and verify the legitimacy of any linked services. Organizations are advised to block the domain and associated IP at the network level to prevent potential re-emergence. The elevated risk level persists due to the domain's history and infrastructure, warranting continued vigilance.