bsop[.]ai-cryptolist[.]com

Analysis indicates that bsop.ai-cryptolist.com is an active crypto drainer phishing domain targeting cryptocurrency users. The domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to the IP address 188.114.97.3, hosted behind Cloudflare in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com), along with technologies such as IPFS, Vue.js, and HTTP/3, which are commonly employed to obfuscate malicious activity and enhance scalability. The domain is flagged by 19 of 94 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain's malicious intent but may contribute to evading basic detection mechanisms. The HTTP status code 302 suggests the site is redirecting visitors, a tactic often used to conceal the final destination or to dynamically serve malicious content based on user behavior or geolocation. The page title 'Just a moment...' is consistent with Cloudflare's interstitial pages, which may indicate the site is using Cloudflare's protection services to filter or delay access while performing checks. However, this behavior is also exploited by threat actors to create a false sense of legitimacy or to mask the true nature of the site during initial scans. The domain is classified under the 'Seed Phrase Phishing' kit, which specifically targets cryptocurrency wallet recovery phrases, a critical vector for crypto drainer attacks. Defenders should treat this domain as high-risk. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or managing digital assets. Given the use of Cloudflare and IPFS, monitoring for related infrastructure (e.g., additional domains resolving to the same IP or sharing SSL certificates) may help identify broader campaign activity.