desci-pepe[.]ai-cryptolist[.]com

This domain, desci-pepe.ai-cryptolist.com, is flagged as an active crypto drainer phishing site designed to compromise cryptocurrency wallet credentials and drain funds. Analysis indicates the infrastructure mimics decentralized finance (DeFi) platforms, specifically leveraging the Pepe meme token branding to lure victims into connecting wallets to malicious smart contracts. No known legitimate association with Pepe or affiliated projects exists, and the domain exhibits hallmarks of a drainer kit deployment, including obfuscated JavaScript and wallet signature interception. Infrastructure analysis reveals the following technical indicators: the domain is detected by 18 out of 95 security vendors on VirusTotal, with a creation date of April 11, 2026, suggesting potential domain squatting or preemptive registration for malicious use. It is registered through Key-Systems GmbH and currently resolves to an IP address associated with bulletproof hosting providers. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate, while the domain appears on one security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing (GSB) status remains unconfirmed, but the elevated detection rate and blocklist presence corroborate malicious intent. The domain remains active and poses an elevated risk to users interacting with cryptocurrency platforms. Immediate response actions include blacklisting the domain across security gateways, revoking SSL trust for the certificate, and notifying the registrar of abuse. Despite these measures, residual risk persists due to the domain's recent registration and the use of reputable certificate authorities to evade detection. Users are advised to verify wallet connections, avoid interacting with unsolicited DeFi links, and monitor for unauthorized transactions. Organizations should update threat intelligence feeds to include this domain and its associated indicators of compromise.