metaplanet-ethereum[.]ai-cryptolist[.]org

Analysis of the domain metaplanet-ethereum.ai-cryptolist.org shows active infrastructure supporting a high‑risk brand‑impersonation campaign targeting Ethereum users. The domain was registered on April 11 2026 through Key‑Systems GmbH and is hosted on Cloudflare’s network, resolving to IP 188.114.97.3, which geolocates to Canada and is owned by CloudFlare, Inc. DNS is served by abdullah.ns.cloudflare.com and harlee.ns.cloudflare.com. HTTPS is enabled with a certificate issued by Google Trust Services / WE1, indicating a legitimate TLS chain despite malicious intent. HTTP requests return a 302 redirect and the sole observed page title is "Just a moment...", a generic placeholder often used to conceal malicious payloads. Reputation scoring is extremely low (Gridinsoft 0/100) and VirusTotal reports 17 of 94 scanners flagging the domain, confirming suspicious behavior. The domain appears on one public blocklist and is already blocked by PhishDestroy, suggesting that security communities have begun to mitigate its activity. While the exact landing page content has not been disclosed, the combination of brand‑impersonation labeling, the Ethereum target, and the observed infrastructure points to a credential‑harvesting or scam operation. Defenders should block DNS resolution to 188.114.97.3, enforce TLS inspection for traffic to the domain, and monitor for any user‑initiated requests that result in a 302 redirect to "Just a moment...". Email and web gateways should add the domain to deny lists, and incident response teams should advise users to avoid any unsolicited communications referencing Ethereum that direct them to this URL.