elon-mars-token[.]ai-cryptolist[.]com

This domain, elon-mars-token.ai-cryptolist.com, is flagged as an active high-risk crypto scam targeting users with a fraudulent token offering. Registered on April 11, 2026, through Key-Systems GmbH, the domain currently resolves to the IP address 188.114.96.3, hosted under Cloudflare’s infrastructure in Canada. Analysis indicates the use of Cloudflare nameservers (aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), which are common in both legitimate and malicious deployments. The domain appears on at least one security blocklist, and 18 of 94 security vendors on VirusTotal have detected it as malicious, suggesting moderate but not universal recognition of its threat status. The HTTP response code is 403 (Forbidden), and the page title reads 'Just a moment...', a default Cloudflare challenge page that may indicate the site is either undergoing filtering or attempting to evade automated detection. The scam type is explicitly classified as a crypto scam, though the exact mechanics—whether a fake token sale, wallet drainer, or impersonation of a known project—remain unconfirmed due to the lack of direct page content analysis. Defenders should treat this domain as hostile and prioritize blocking it at the DNS, IP, and certificate levels. The registration age (three months) and continued activity suggest the campaign is ongoing, and the use of Cloudflare may complicate takedown efforts. Additional monitoring of related domains registered through the same registrar or resolving to the same IP range is recommended to identify potential lateral threats.