ithaca-protocol[.]ai-cryptolist[.]com

The domain ithaca-protocol.ai-cryptolist.com is identified as a crypto-focused phishing infrastructure currently offline. Analysis indicates this domain was designed to impersonate legitimate cryptocurrency protocols or platforms, likely targeting users with fraudulent investment schemes, wallet credential harvesting, or token scams. The domain's current status as offline suggests either temporary takedown or operational pause, though historical activity remains a concern for security teams. Infrastructure analysis reveals this domain was flagged by 17 of 95 security vendors on VirusTotal, indicating moderate but consistent detection across threat intelligence platforms. Registered through Key-Systems GmbH, the domain resolved to IP address 188.114.96.3, a hosting provider commonly associated with bulletproof infrastructure. Created on April 11, 2026, the domain exhibits future-dated registration, a tactic frequently observed in phishing campaigns to evade immediate detection. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, further confirming its malicious classification. The SSL certificate issued by Google Trust Services may have been leveraged to lend superficial legitimacy to the phishing pages. Current status shows the domain as offline, though the infrastructure remains a latent risk. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Security teams should monitor for related domains using the 'ithaca-protocol' or 'ai-cryptolist' naming patterns, as threat actors frequently reuse branding elements across campaigns. End users should verify cryptocurrency platforms through official channels only and avoid interacting with domains promising unrealistic returns or requiring urgent wallet access. Historical DNS records and SSL certificate fingerprints may provide additional indicators for retrospective threat hunting.