swisscheese[.]ai-cryptolist[.]com

The domain swisscheese.ai-cryptolist.com has been identified as a crypto wallet drainer phishing site, designed to exfiltrate cryptocurrency assets from victims through fraudulent transaction prompts or malicious smart contract interactions. As of the latest verification, the domain is offline, though prior activity and infrastructure analysis confirm its malicious intent. No legitimate brand impersonation has been confirmed; instead, the domain appears to target users through generic crypto-related lures, likely distributed via social engineering or malvertising campaigns. Analysis indicates the domain was registered through Key-Systems GmbH on April 11, 2026, an unusually forward-dated creation that may suggest domain generation algorithm (DGA) abuse or intentional obfuscation. It resolves to the IP address 188.114.96.3, a host previously associated with other phishing and scam operations. The domain is flagged by 18 of 95 security vendors on VirusTotal, with additional detections from at least one security blocklist. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious sites. The page title, 'Just a moment...', is consistent with cloaking behavior or intermediate redirect pages used to filter traffic and evade detection. Current infrastructure status is offline, though historical indicators and residual risk remain elevated. Organizations and individuals are advised to block the domain and associated IP at the network perimeter. End-users should verify all crypto transaction requests through official wallet interfaces and avoid interacting with unsolicited links or prompts. Security teams are encouraged to monitor for related domains using similar naming patterns (e.g., 'ai-cryptolist', 'swisscheese') and to review logs for connections to 188.114.96.3. Given the domain's registration date anomaly, further investigation into registrar abuse or bulk domain registration patterns is recommended.