balltze[.]ai-cryptolist[.]com

This domain is flagged as an active crypto wallet drainer, designed to deceive cryptocurrency users into authorizing malicious transactions. Once a user connects their wallet to the site, the embedded malicious scripts automatically siphon funds to attacker-controlled addresses. The threat primarily targets users searching for cryptocurrency airdrops, token lists, or investment opportunities, exploiting their trust in seemingly legitimate platforms. Analysis indicates the domain was registered on April 11, 2026, through Key-Systems GmbH, a registrar commonly used for both legitimate and malicious domains. It resolves to the IP address 188.114.96.3, which is part of a content delivery network infrastructure. The domain is detected by 18 out of 95 security vendors on VirusTotal, with one security blocklist already listing it as malicious. The SSL certificate is issued by Google Trust Services, providing a false sense of security to visitors. Additionally, the site employs Cloudflare and HTTP/3, technologies often used to obfuscate malicious activity and evade detection. If a user has visited balltze.ai-cryptolist.com or interacted with it, immediate action is required. First, disconnect any connected wallets from the site and revoke all permissions granted to unknown or suspicious contracts using a blockchain explorer. Next, transfer all remaining assets to a new, secure wallet and monitor all connected accounts for unauthorized transactions. Users should also scan their devices for malware, as crypto drainers may deploy additional payloads. Finally, report the incident to relevant security teams and consider filing a report with local cybercrime authorities to aid in tracking the threat actors.