automatic-treasury-machine[.]ai-cryptolist[.]net

The domain automatic-treasury-machine.ai-cryptolist.net was registered on November 5, 2025 through Key-Systems GmbH and is hosted behind Cloudflare infrastructure, resolving to IP 172.67.198.248 located in California. The site presents a Cloudflare‑generated page titled "Suspected Misleading Website | Cloudflare" and returns HTTP status 403, indicating that access is being blocked at the edge. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming a valid HTTPS endpoint. VirusTotal scans show that 17 of 91 security vendors flag the domain, and it appears on a single security blocklist. PhishDestroy has already listed the domain as malicious, and Gridinsoft assigns it a trust score of 0 out of 100, reinforcing the high‑risk classification. The listed scam type is brand impersonation targeting Polygon, though the exact content or credential‑harvesting mechanisms have not been publicly disclosed. Defenders should immediately block the domain at DNS and web‑proxy layers, add the associated IP address to network‑level deny lists, and monitor outbound traffic for attempts to resolve or connect to the domain. Email filtering rules should be updated to flag any messages referencing Polygon that contain links to this domain or its subdomains. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise related to the same Cloudflare edge IP, and incident response teams should be prepared to investigate any user reports of fraudulent Polygon communications that reference the domain.