aurk-ai[.]ai-cryptolist[.]org

PhishDestroy’s automated systems flagged the domain aurk-ai.ai-cryptolist.org as a live crypto-draining phishing site masquerading as the legitimate AI-cryptolist platform. The page is designed to trick visitors into connecting crypto wallets under the guise of token listings, using a fake UI that intercepts and drains funds via a crypto-drainer kit hosted on the server. At this stage no specific drainer payload hash is publicly available, but the site’s structure and SSL certificate point to a newly staged operation built to harvest private keys and seed phrases.

Technical indicators confirm this domain is a high-fidelity threat. VirusTotal reports 3/95 detection engines flagging the URL as malicious, indicating zero coverage from current AV and browser defenses. The domain resolves to IP 188.114.96.3, a Cloudflare front behind which the drainer backend operates. Registered via Key-Systems GmbH on November 05, 2025, the domain obtained a Google Trust Services SSL certificate on the same day, ensuring a green padlock that lowers user suspicion. Despite this, PhishDestroy’s proprietary crawlers rate it active and under investigation, and it remains unlisted on any major threat-intel blocklist at the time of analysis.

As of this report, the domain is still active and distributing its crypto drainer payloads. PhishDestroy has escalated the IOCs to Google Safe Browsing and issued takedown requests to Cloudflare and the registrar. Users are strongly advised to block both the domain and IP at firewall and DNS level. Remaining risk is assessed as medium until takedown confirmation is received; therefore continuous monitoring and immediate network-level blocking are recommended to neutralize the threat.