rapid-fun[.]ai-cryptolist[.]org

This domain, rapid-fun.ai-cryptolist.org, was confirmed to host a cryptocurrency credential phishing operation targeting users through fraudulent wallet login pages or crypto exchange impersonation. Analysis of the page title 'Just a moment...' and infrastructure suggests the site employed evasion techniques, such as Cloudflare-like waiting screens, to delay detection while harvesting sensitive credentials like private keys, seed phrases, or exchange login details. The domain’s focus on cryptocurrency aligns with recent trends in high-value phishing campaigns aimed at digital asset theft. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Key-Systems GmbH and resolved to the IP address 188.114.96.3. It was flagged by 17 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection across threat intelligence platforms. The domain also appeared on one security blocklist prior to being taken offline. The SSL certificate, issued by Google Trust Services, provided a false sense of legitimacy while the site operated under a low trust score of 0/100 from independent assessments. Users who visited rapid-fun.ai-cryptolist.org or entered credentials on the site should immediately revoke any exposed private keys, seed phrases, or passwords. Affected wallets or exchange accounts must be migrated to new, secure credentials, and all connected devices should undergo a malware scan to detect potential secondary infections. Monitor linked accounts for unauthorized transactions, and report the incident to relevant financial or cryptocurrency platforms to initiate fraud mitigation procedures. Given the domain’s cryptocurrency focus, assume any interaction with the site resulted in credential compromise.