sonic[.]ai-cryptolist[.]net

The domain sonic.ai-cryptolist.net is identified as a cryptocurrency-focused phishing resource targeting users through deceptive wallet or exchange impersonation. Analysis confirms the domain is currently offline, though prior activity indicates it was actively used in credential harvesting operations. No specific legitimate brand impersonation has been conclusively linked, but the structure and naming convention strongly suggest intent to exploit cryptocurrency-related trust signals. Infrastructure analysis reveals the domain was registered through Key-Systems GmbH and resolves to the IP address 172.67.198.248, a Cloudflare proxy endpoint. The domain was created on April 11, 2026, and is flagged by 17 of 95 security vendors on VirusTotal. It appears on one security blocklist and is assigned a trust score of 0/100 by Gridinsoft. Technical indicators include the use of IPFS for content distribution, Vue.js for frontend rendering, and HTTP/3 protocol support, all proxied behind Cloudflare. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious infrastructure. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the registration remains active, posing a potential risk for future reactivation. Organizations and individuals are advised to block the domain at the DNS level, monitor for related subdomains or IP reuse, and update endpoint protection rules to include this indicator. Users who interacted with the domain should assume credential compromise and initiate password resets on any associated cryptocurrency platforms. Security teams should correlate this domain with other cryptocurrency-themed phishing campaigns for broader threat context.