origin[.]ai-cryptolist[.]net

This domain, origin.ai-cryptolist.net, is flagged as a crypto phishing drainer targeting cryptocurrency users through fraudulent asset listings. Analysis of the page title, CRYPTOLIST, and detected technologies indicates an attempt to mimic legitimate cryptocurrency tracking or investment platforms. No direct brand impersonation is confirmed, but the domain leverages deceptive design to trick users into connecting wallets or disclosing private keys, facilitating unauthorized fund transfers. Infrastructure analysis reveals precise technical indicators: the domain is detected by 17 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Registered through Key-Systems GmbH on April 11, 2026, the domain employs Cloudflare for hosting and IPFS for content distribution, alongside Vue.js for dynamic frontend rendering. The SSL certificate is issued by Google Trust Services, and the domain appears on a single security blocklist. No Google Safe Browsing (GSB) flags are recorded at the time of analysis, though HTTP/3 is enabled, potentially complicating traffic inspection. The domain has been taken offline, likely due to enforcement actions by security providers or registrar intervention. Despite its current inactive status, residual risk persists for users who may have interacted with the domain prior to its removal. Organizations are advised to block the domain at the DNS and proxy levels, revoke any associated SSL certificates, and monitor for wallet addresses or scripts linked to this campaign. End users should verify cryptocurrency platforms via official sources and avoid connecting wallets to untrusted sites, even if they appear legitimate.