test-ai-agent[.]ai-cryptolist[.]com

The domain test-ai-agent.ai-cryptolist.com has been identified as a credential theft operation targeting cryptocurrency users. Analysis indicates the site employs AI-themed social engineering tactics to harvest login credentials, wallet keys, or other sensitive authentication data. As of the latest assessment, the domain is currently offline, though prior activity suggests it may reactivate under similar infrastructure or naming conventions. Infrastructure analysis reveals the domain was registered on April 11, 2026, through Key-Systems GmbH, a registrar frequently observed in malicious campaigns. It resolves to the IP address 188.114.97.3, which has been associated with other high-risk domains. Security vendors have flagged this domain in 18 of 95 VirusTotal submissions, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to fraudulent sites. Trust scoring from Gridinsoft rates the domain at 0/100, reinforcing its malicious classification. The page title 'Just a moment...' is consistent with cloaking techniques used to evade automated detection or delay user awareness of the threat. Current status indicates the domain has been taken offline, though the underlying infrastructure remains a potential risk. Organizations and individuals are advised to block the domain and its associated IP at the network level. Users who may have interacted with the site should immediately rotate credentials for cryptocurrency wallets, exchanges, or any services accessed during the exposure window. Monitoring for similar AI-themed domains (e.g., variations of 'ai-cryptolist') is recommended, as threat actors frequently reuse naming patterns. Network defenders should prioritize retroactive log analysis to identify any prior engagement with this domain or its IP, particularly in environments handling cryptocurrency transactions.