made-in-america[.]ai-cryptolist[.]net

Analysis of the domain made-in-america.ai-cryptolist.net shows a recently registered (April 11 2026) web address hosted behind Cloudflare’s network (IP 104.21.68.219, CA). The domain is served over TLS with a Google‑issued certificate (WE1) and supports HTTP/3. DNS resolution uses Cloudflare’s authoritative name servers melissa.ns.cloudflare.com and miles.ns.cloudflare.com. An HTTP 302 redirect returns a page whose title is “Just a moment…”, indicating an interstitial or challenge page rather than a final landing page. The site is listed on one security blocklist and has been flagged by 18 of 94 VirusTotal scanners, reflecting a moderate detection rate. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on the PhishDestroy blocklist. The underlying malicious payload has been identified as a “Seed Phrase Phishing” kit, which typically harvests cryptocurrency recovery phrases. Infrastructure signals—including Cloudflare protection, rapid domain creation, and the use of a generic interstitial title—are consistent with active phishing campaigns. No additional content analysis is available, so the exact appearance of the phishing page remains unknown. Defenders should block or sinkhole the domain at the network perimeter, monitor DNS queries for the associated IP and name servers, and add the host to internal URL filtering lists. Continuous re‑scanning is recommended to capture any changes in the payload or detection status.