elf[.]ai-cryptolist[.]org

This domain, elf.ai-cryptolist.org, is flagged as an elevated-risk crypto drainer phishing site designed to siphon cryptocurrency from victim wallets. Analysis indicates the threat actor employed social engineering tactics, presenting a fraudulent interface labeled 'CRYPTOLIST' to trick users into connecting their wallets, likely leading to unauthorized fund transfers. The domain exhibits characteristics typical of crypto-focused phishing, including the use of decentralized storage (IPFS) and modern web frameworks (Vue.js) to obfuscate malicious activity. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Key-Systems GmbH, an uncommon date suggesting potential domain squatting or pre-registration for malicious use. The site is currently offline, but historical data shows it was hosted behind Cloudflare, leveraging HTTP/3 for performance and evasion. Security telemetry indicates the domain appeared on 1 security blocklist, with a Gridinsoft trust score of 0/100. VirusTotal detections reached 17/95 vendors, confirming its malicious classification. The SSL certificate was issued by Google Trust Services, a legitimate provider often abused to lend credibility to phishing sites. Mitigation requires immediate action from both users and network defenders. Users who interacted with elf.ai-cryptolist.org should revoke wallet permissions, transfer remaining funds to a new wallet, and scan devices for malware. Network defenders should block the domain at DNS and proxy levels, monitor for connections to IPFS gateways associated with this threat, and deploy signatures to detect Vue.js-based phishing pages. Given the use of Cloudflare, defenders should also inspect HTTP/3 traffic for anomalous patterns. Cryptocurrency platforms should alert users about this drainer campaign and provide guidance on verifying legitimate interfaces.