mxs-games[.]ai-cryptolist[.]com

Analysis of mxs-games.ai-cryptolist.com indicates an active phishing domain targeting Cloudflare users, specifically designed to operate as a crypto drainer. The domain was registered on April 11, 2026, through Key-Systems GmbH, and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure in Canada. The nameservers, aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com, further confirm Cloudflare's network involvement, though this is consistent with both legitimate and malicious use of the service. The domain's SSL certificate is issued by Google Trust Services (WE1), a common certificate authority that does not inherently indicate malicious intent. However, the page title, 'Suspected Misleading Website | Cloudflare,' explicitly signals an attempt to impersonate Cloudflare, aligning with the brand impersonation classification. At the time of this report, 18 of 94 security vendors on VirusTotal have flagged the domain as malicious, and it appears on at least one security blocklist, including PhishDestroy. Gridinsoft assigns it a trust score of 0/100, reinforcing its high-risk status. Infrastructure analysis reveals the domain is still active, though it currently returns an HTTP 403 status, which may indicate either a temporary block or a cloaking mechanism to evade detection. The scam type is confirmed as a crypto drainer, suggesting the domain is likely used to deceive victims into connecting wallets or authorizing transactions that result in unauthorized fund transfers. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Given its association with Cloudflare's infrastructure, monitoring for similar domains using the same nameservers or IP ranges may help identify related threats. The exact content and functionality of the site remain unanalyzed, but the available evidence confirms its malicious intent and ongoing activity as of July 12, 2026.