kekius-maximus-eth-vip[.]next-cryptolist[.]net

This domain, kekius-maximus-eth-vip.next-cryptolist.net, is identified as a crypto drainer phishing operation designed to target Ethereum wallet users. Analysis indicates the domain mimics legitimate cryptocurrency VIP access or reward pages, likely deploying a wallet-draining script upon interaction. No direct brand impersonation is observed, but the structure suggests an attempt to exploit users seeking exclusive Ethereum-related offers or airdrops. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to the IP address 172.67.181.166. It is protected by Cloudflare, utilizing HTTP/3 for communication. The SSL certificate is issued by Google Trust Services. VirusTotal reports 18 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist, and no Google Safe Browsing (GSB) detections are recorded at this time. The domain remains active and poses an elevated risk to users interacting with cryptocurrency-related content. Immediate response actions include blocking the domain at the DNS and network perimeter levels, as well as alerting users to the presence of wallet-draining scripts. Despite mitigation efforts, the domain's use of Cloudflare and HTTP/3 may complicate takedown procedures. Users are advised to verify domain authenticity before connecting wallets and to employ hardware or isolated software wallets for high-value transactions.