deepcore-ai[.]next-cryptolist[.]net

This domain, deepcore-ai.next-cryptolist.net, is identified as a crypto-focused phishing infrastructure designed to deceive users into divulging wallet credentials or transferring digital assets. Analysis indicates the site likely employs a crypto drainer kit, a common tool in phishing campaigns targeting cryptocurrency holders. The domain mimics legitimate AI-driven crypto platforms, leveraging branding elements to enhance credibility and trick victims into interacting with malicious smart contracts or fake login portals.

Technical indicators confirm the domain's malicious nature. It was registered on April 11, 2026, through Key-Systems GmbH and resolves to the IP address 104.21.64.107, which is proxied through Cloudflare. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is blocked by at least one anti-phishing service. The SSL certificate is issued by Google Trust Services, a common practice among threat actors to lend a veneer of legitimacy to phishing sites. HTTP/3 is also detected, indicating the use of modern web protocols to evade traditional detection mechanisms.

As of the latest assessment, deepcore-ai.next-cryptolist.net has been taken offline, likely in response to detection and reporting. However, the infrastructure remains a residual risk. The domain's registration remains active, and the threat actor may redeploy the phishing kit under a new domain or IP address. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of any linked crypto services. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.