ai-gcr[.]entry-cryptolist[.]app

The domain ai-gcr.entry-cryptolist.app has been identified as a generic phishing threat, targeting users with fraudulent credential harvesting schemes. No specific brand or drainer kit was associated with this domain during analysis. PhishDestroy's investigation reveals that this domain was hosted on the IP address 188.114.97.3 and registered through Key-Systems LLC, a registrar known for minimal oversight. With a VirusTotal detection score of 12 out of 95 security vendors flagging the domain as malicious, the threat level is elevated, indicating a notable risk to users who may encounter it.

Technical indicators show that the domain appeared on one security blocklist at the time of analysis and was not listed on Google Safe Browsing (GSB), meaning it may have evaded some automated protections. The SSL certificate was issued by Google Trust Services / WE1, which is a legitimate certificate authority, adding a layer of deception to the phishing operation. The domain's creation date was not provided, but its current status is offline, suggesting that hosting providers or registrars have taken action to suspend the service. However, the fact that the domain was flagged by 12 vendors underscores the severity of the threat.

As of the latest update, the domain is offline, and PhishDestroy recommends users remain cautious, as similar domains may reappear under different registrars or IP addresses. Users who have interacted with this domain should change their passwords and monitor accounts for suspicious activity. PhishDestroy continues to monitor threats associated with the seed 04f24d to provide timely updates and protect against emerging phishing campaigns. Check the full report for a detailed breakdown and actionable safety guidance.