skynet[.]ai-cryptolist[.]org

Analysis of skynet.ai-cryptolist.org shows a newly registered domain (created 2026‑04‑11) that resolves to the Cloudflare‑owned address 188.114.97.3 located in Canada. The site is protected by a Google Trust Services / WE1 SSL certificate, yet the only observed HTTP response is a 302 redirect and the page title returned is “Just a moment…”. Reputation scoring from Gridinsoft assigns a trust score of 0/100, and the domain appears on a single security blocklist. VirusTotal scans have flagged the domain in 17 of 94 engines, and it is currently listed as blocked by PhishDestroy. Registration was performed through Key‑Systems GmbH and the authoritative nameservers are abdullah.ns.cloudflare.com and harlee.ns.cloudflare.com. The combination of recent registration, low trust score, active blocklist presence, and multiple antivirus detections points to a high‑risk phishing infrastructure. No further content, targeted brand, or payload details have been disclosed, leaving the specific phishing lure uncertain. Defenders should add the domain and its IP address to outbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and enforce TLS inspection to capture any redirected payload. Continuous re‑evaluation is advised as additional intelligence emerges.