tardi[.]ai-cryptolist[.]org

This domain, tardi.ai-cryptolist.org, is flagged as a generic phishing site targeting cryptocurrency users. Analysis indicates the infrastructure is designed to mimic legitimate wallet services, likely deploying a Vue.js-based drainer kit to harvest credentials and exfiltrate digital assets. The presence of IPFS and HTTP/3 technologies suggests an attempt to evade traditional detection mechanisms while maintaining persistence through decentralized hosting. Infrastructure analysis reveals the domain was registered through Key-Systems GmbH on April 11, 2026, an anomalous future date that may indicate registry manipulation or data obfuscation. It resolves to IP address 188.114.96.3, a Cloudflare node commonly exploited for bulletproof hosting. Detection metrics show 17 out of 95 security vendors flagging the domain on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, a legitimate provider frequently abused in phishing operations. As of the latest verification, tardi.ai-cryptolist.org has been taken offline, likely following abuse reports or registrar intervention. However, the underlying infrastructure remains a residual risk, as the IP address and associated technologies may be repurposed for future campaigns. Users are advised to monitor wallet addresses for unauthorized transactions and verify domain registration dates for anomalies. Network defenders should implement real-time DNS filtering for domains resolving to 188.114.96.3 and scrutinize future registrations from the same registrar for similar patterns.