x-money[.]ai-cryptolist[.]net

The domain x-money.ai-cryptolist.net has been identified as a generic phishing threat by PhishDestroy's analysis. This domain does not impersonate a specific brand but is designed to deceive users into revealing sensitive information, likely through credential harvesting or financial fraud. No specific drainer kit was detected, but the domain's structure suggests it may be part of a broader phishing campaign targeting cryptocurrency or financial services.

Technical indicators reveal a risk profile that warranted an elevated threat level. VirusTotal flagged the domain with a score of 1/95, meaning one out of 95 security vendors detected malicious activity. The domain was registered on April 11, 2026, through Key-Systems GmbH, and resolves to IP address 104.21.68.219. It appears on one security blocklist and was not listed on Google Safe Browsing. The SSL certificate was issued by Google Trust Services (WE1), which is common for benign sites but does not guarantee safety. The page title "Just a moment..." is typical of Cloudflare challenges, often used by phishing sites to delay analysis.

Currently, the domain is offline, indicating that it has been taken down, likely due to reports or automated detection. However, the risk remains that similar domains may appear under different names. Users who encountered this site should change any credentials entered and monitor accounts for suspicious activity. PhishDestroy recommends avoiding any interaction with such domains and reporting them to security authorities. The quick takedown response reduces immediate danger, but vigilance is advised as phishing campaigns often adapt rapidly.