simon-the-nyc-dog-mayor[.]ai-cryptolist[.]com

Analysis of the domain simon-the-nyc-dog-mayor.ai-cryptolist.com indicates active cryptocurrency-themed phishing infrastructure. The domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to 188.114.96.3, a Cloudflare-hosted IP located in Canada. Nameservers are set to Cloudflare’s aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com, consistent with threat actors leveraging Cloudflare’s proxy services to obscure origin servers. The observed HTTP status is 302, suggesting a redirect mechanism, while the page title 'CRYPTOLIST' aligns with cryptocurrency-related lures. SSL certification is provided by Google Trust Services (WE1), and detected technologies include IPFS, Vue.js, Cloudflare, and HTTP/3, which may facilitate content delivery and evasion of traditional security controls. The domain holds a Gridinsoft trust score of 0/100 and is flagged by 18 of 94 security vendors on VirusTotal, with PhishDestroy currently blocking it. Despite these indicators, the exact nature of the phishing content remains unconfirmed, as no brand-specific targeting or scam kit details are available in the intelligence. Defenders should treat this domain as high-risk, particularly in environments where cryptocurrency transactions or user credentials are processed. Immediate blocking at DNS and proxy layers is recommended, alongside monitoring for related infrastructure patterns, such as similarly named subdomains or additional Cloudflare-proxied IPs.