gridium-ai[.]ai-cryptolist[.]com

This domain, gridium-ai.ai-cryptolist.com, is identified as a crypto wallet drainer phishing site designed to deceive cryptocurrency users into connecting their wallets to malicious smart contracts. Once connected, the infrastructure automatically executes unauthorized transactions, draining assets from victims' wallets without consent. The domain mimics legitimate cryptocurrency services, leveraging social engineering tactics such as fake token airdrops, investment scams, or fraudulent exchange interfaces to lure targets into interacting with the malicious payloads.

Analysis indicates the domain is registered through Key-Systems GmbH and was created on April 11, 2026, suggesting a recently deployed phishing campaign. It resolves to the IP address 188.114.97.3 and is flagged by 17 out of 95 security vendors on VirusTotal, with one confirmed appearance on a security blocklist. The infrastructure employs Cloudflare for hosting and utilizes HTTP/3, while its SSL certificate is issued by Google Trust Services. Despite its current offline status, the domain maintains a Gridinsoft trust score of 0/100, reinforcing its classification as high-risk.

Users who visited gridium-ai.ai-cryptolist.com or interacted with its content should immediately revoke any wallet connections associated with the site. Monitor all linked wallets for unauthorized transactions and transfer remaining assets to a new, secure wallet. Report the domain to relevant cryptocurrency platforms and security teams to assist in broader mitigation efforts. If financial losses occurred, file a report with local cybercrime authorities and provide all transaction hashes, timestamps, and communication logs for investigation.