upril[.]ai-cryptolist[.]net

This domain, upril.ai-cryptolist.net, is flagged as an active high-risk phishing site targeting cryptocurrency users through a seed phrase phishing kit. Registered on April 11, 2026, via Key-Systems GmbH, the domain resolves to the IP address 104.21.68.219, which is associated with Cloudflare, Inc. in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (melissa.ns.cloudflare.com and miles.ns.cloudflare.com) and HTTP/3 technology, alongside a 302 HTTP status redirect, suggesting attempts to evade detection or automate victim redirection. The domain currently presents a page titled 'Just a moment...', a common placeholder used during proxy-based filtering or while loading malicious content. As of July 12, 2026, the domain remains active and is detected by 16 of 94 security vendors, indicating moderate but not universal recognition of its malicious nature. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the phishing risk but may contribute to evading basic browser warnings. The domain appears on at least one security blocklist and is classified as a seed phrase phishing threat, though the exact mechanics of the phishing kit—such as whether it harvests credentials via fake wallet interfaces or social engineering—are not yet confirmed due to limited page content analysis. Defenders should treat this domain as actively hostile. Network-level blocking of 104.21.68.219 and the domain itself is recommended, alongside monitoring for related subdomains or newly registered domains under the same registrar. Given the use of Cloudflare, additional scrutiny of domains sharing the same nameservers or IP range may uncover further malicious infrastructure. The domain’s recent creation and continued activity suggest it is part of an ongoing campaign, and organizations handling cryptocurrency transactions should prioritize user education regarding seed phrase security.