vaultram[.]ai-cryptolist[.]org

Analysis of vaultram.ai-cryptolist.org shows a high‑risk infrastructure used for a crypto‑drainer operation. The domain was registered on April 11, 2026 through Key-Systems GmbH and is currently protected by Cloudflare, resolving to IP 188.114.96.3 located in Canada. HTTP traffic returns a 302 redirect and the only observable page title is "Just a moment...". The site serves a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint. Malware scanning on VirusTotal reports 17 of 94 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The observed phishing kit is identified as a Seed Phrase Phishing module, consistent with the listed scam type of Crypto Drainer. The domain is already blocked by PhishDestroy and appears on one external blocklist. Nameservers abdullah.ns.cloudflare.com and harlee.ns.cloudflare.com confirm the Cloudflare front‑end. No additional page content has been disclosed, so the exact credential‑capture flow remains unverified. Defenders should add the domain to URL filtering and firewall deny lists, enforce outbound traffic monitoring for connections to 188.114.96.3, and update detection rules to flag HTTP 302 responses paired with the "Just a moment..." title from this host. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise linked to the Seed Phrase Phishing kit.