pochita[.]ai-cryptolist[.]com

This domain, pochita.ai-cryptolist.com, is currently flagged as an active cryptocurrency credential phishing site. Analysis indicates it is specifically designed to harvest wallet credentials, private keys, or multi-factor authentication codes from cryptocurrency users. The domain remains operational and continues to host malicious infrastructure despite partial detection by security systems. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Key-Systems GmbH, a registrar frequently observed in phishing campaigns. It resolves to the IP address 188.114.97.3 and is protected by Cloudflare, utilizing HTTP/3 for enhanced delivery speed and evasion of traditional network monitoring. The domain appears on one security blocklist and has been flagged by 17 of 95 security vendors on VirusTotal, indicating moderate but inconsistent detection across the security community. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to potential victims. Current threat assessment classifies this domain as elevated risk due to its active status, targeted nature, and use of evasive hosting practices. Organizations and individuals are advised to block the domain at the DNS level and the associated IP address 188.114.97.3. Endpoint protection systems should be updated to include this domain in phishing and malicious site categories. Users who may have interacted with the domain should immediately revoke any exposed credentials, enable multi-factor authentication on all cryptocurrency accounts, and monitor for unauthorized transactions. Security teams are encouraged to review logs for connections to this domain or IP address and investigate any potential compromise.