lemonrocks[.]ai-cryptolist[.]net

Analysis of the domain lemonrocks.ai-cryptolist.net indicates an active phishing campaign targeting cryptocurrency users. The domain was registered on November 5, 2025, through Key-Systems GmbH, a registrar commonly associated with both legitimate and malicious registrations. Infrastructure analysis reveals the domain resolves to the IP address 172.67.198.248, which is part of Cloudflare's network, a service frequently utilized to mask the true hosting origin of phishing sites. Nameservers melissa.ns.cloudflare.com and miles.ns.cloudflare.com further confirm Cloudflare's involvement in the domain's DNS resolution. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy.

VirusTotal reports that 17 out of 91 security vendors flag this domain as malicious, suggesting a consensus among detection engines regarding its fraudulent nature. The specific threat classification provided in the intelligence data labels this as a 'generic phishing' campaign, though the exact content or targeted brand remains unconfirmed due to the absence of detailed page analysis. The domain name, however, includes the term 'cryptolist,' which may imply an attempt to impersonate a cryptocurrency-related service, such as a token listing platform or investment portal. Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels.

Given the use of Cloudflare, traditional IP-based blocking may be ineffective; instead, domain-based filtering or DNS sinkholing is recommended. Organizations should monitor for any internal traffic to this domain and investigate potential credential exposure or financial fraud linked to its activity. Further analysis of the site's content, if accessible, could provide additional context regarding the specific phishing techniques employed, such as fake login portals or fraudulent token distribution schemes.