evolvai[.]ai-cryptolist[.]com

This domain, evolvai.ai-cryptolist.com, is identified as a crypto wallet phishing site designed to deceive users into disclosing sensitive credentials or transferring cryptocurrency to attacker-controlled wallets. The infrastructure mimics legitimate cryptocurrency listing platforms, leveraging social engineering tactics such as fake login portals, wallet connection prompts, and fraudulent token sale offers to exploit victims. Analysis indicates the domain specifically targets users of decentralized finance (DeFi) platforms, wallets, and exchanges, with a focus on Ethereum and Binance Smart Chain ecosystems. Evidence confirms the malicious nature of this domain through multiple technical indicators. VirusTotal reports 18 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain was registered on April 11, 2026, through Key-Systems GmbH, an uncommon registrar for legitimate crypto services. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, which has been associated with other phishing campaigns. Despite using a Google Trust Services SSL certificate, the domain remains a high-risk threat due to its fraudulent intent and active blocking by security tools. Users who visited evolvai.ai-cryptolist.com or interacted with its content should take immediate action to mitigate potential compromise. First, disconnect any wallets connected to the site and revoke permissions via blockchain explorers or wallet management tools. Next, scan local devices for malware, particularly browser extensions or scripts that may have been installed. Monitor linked accounts, including cryptocurrency wallets and exchanges, for unauthorized transactions or login attempts. If credentials were entered, reset passwords and enable multi-factor authentication on all related services. Report the incident to relevant security teams or platforms to aid in broader threat mitigation efforts.