creditlink[.]ai-cryptolist[.]com

This domain, creditlink.ai-cryptolist.com, is flagged as a crypto credential theft operation targeting users of cryptocurrency wallet services. Analysis indicates the site mimics legitimate wallet interfaces to harvest private keys, seed phrases, and login credentials, enabling unauthorized access to digital assets. No specific drainer kit signatures were identified in available telemetry, but the domain follows patterns consistent with credential harvesting infrastructure used in recent wallet-draining campaigns. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Key-Systems GmbH, with a creation date suggesting rapid deployment for malicious purposes. It resolves to IP address 188.114.96.3, a host with no prior association to legitimate crypto services. VirusTotal detection ratio stands at 18/95 security vendors, indicating moderate but growing awareness across detection engines. The domain appears on one security blocklist and is currently classified with a Gridinsoft trust score of 0/100. SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy while obscuring malicious intent. Current status shows the domain as offline, though this may reflect temporary takedown or operational pause rather than permanent cessation. Response actions by security providers, including blocking by PhishDestroy, have mitigated immediate exposure, but residual risk remains for users who may have interacted with the site prior to takedown. Organizations should add the domain to internal blocklists and monitor for related infrastructure, particularly subdomains or IPs associated with 188.114.96.3. Users are advised to revoke any wallet authorizations linked to this domain and conduct malware scans on devices used to access it. No legitimate crypto services operate under this domain, and all associated credentials should be considered compromised.