identified-flying-objects[.]ai-cryptolist[.]org

The domain identified-flying-objects.ai-cryptolist.org has been identified as a crypto wallet drainer, a specialized phishing threat designed to siphon cryptocurrency assets from victims by exploiting deceptive wallet connection prompts. As of the latest verification, the domain has been taken offline, though prior activity remains a concern for historical exposure. Analysis indicates this infrastructure was actively targeting users of cryptocurrency platforms, likely through social engineering tactics such as fake airdrop campaigns or fraudulent token claims. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, indicating moderate detection coverage but sufficient confirmation of malicious intent. It resolved to the IP address 188.114.96.3 and appeared on at least one security blocklist. The domain was registered on April 11, 2026, through Key-Systems GmbH, a registrar frequently observed in phishing operations due to its accessibility and bulk registration capabilities. The SSL certificate was issued by Google Trust Services, a common provider for both legitimate and malicious domains, which does not inherently validate the site's authenticity. The Gridinsoft trust score for this domain was 0 out of 100, reinforcing its classification as a high-risk resource. Current status confirms the domain is offline, reducing immediate exposure risks. However, the infrastructure may resurface under a different domain or IP configuration. Organizations and individuals are advised to block the domain and its associated IP at the network level. Cryptocurrency users should verify all wallet connection requests through official channels and avoid interacting with unsolicited links, particularly those promoting airdrops or token giveaways. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to preemptively mitigate related threats.