gork-ai-agent[.]next-cryptolist[.]net

This domain, gork-ai-agent.next-cryptolist.net, is identified as a crypto-focused phishing infrastructure designed to deploy wallet drainer kits. Analysis indicates the site impersonates no specific brand but operates under a generic cryptocurrency-themed lure, likely targeting users through deceptive prompts to connect digital wallets. The absence of a known brand association suggests a broader, opportunistic campaign rather than a targeted impersonation effort. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to the IP address 104.21.64.107. VirusTotal detections show 18 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious sites to evade basic detection. No Google Safe Browsing (GSB) flags were reported at the time of analysis. The domain has been taken offline, likely due to enforcement actions by security providers or registrar intervention. Despite its current inactive status, residual risk persists for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for related indicators, including the IP address and SSL certificate issuer, as threat actors frequently reuse infrastructure components across campaigns. End-users should verify wallet interactions and revoke unauthorized access to mitigate potential asset loss.