aicryptoet[.]com

Analysis of aicryptoet.com indicates a deliberately crafted phishing operation targeting cryptocurrency investors. The domain was registered on August 02, 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare address 172.67.164.77, which is associated with ASN 13335 in the United States. No SSL certificate was detected, meaning the site was served over plain HTTP at the time of observation. The page title returned by the server, "AI Crypto: Crypto Derivatives Exchange," suggests an attempt to impersonate a legitimate crypto‑derivatives platform, though the exact brand is not disclosed in the collected data.

Infrastructure analysis shows the domain is hosted on Cloudflare’s edge network, utilizing the nameservers grant.ns.cloudflare.com and katelyn.ns.cloudflare.com. Reputation services provide uniformly negative scores: Gridinsoft assigns a trust score of 0 / 100 and Scamadviser rates the site at 11 / 100. VirusTotal scans recorded a single detection out of 95 security vendors, and the domain appears on one public blocklist. It has also been flagged and blocked by the PhishDestroy service.

Current measurements indicate the site is offline, but the historical evidence is sufficient to justify mitigation. Defenders should immediately add aicryptoet.com to URL filtering and DNS blocklists, enforce outbound traffic controls to the underlying IP 172.67.164.77, and monitor for any re‑registration or resurgence of the domain on Cloudflare infrastructure. Email security gateways should be updated to flag messages containing the domain or similar lexical patterns related to "AI Crypto" and "Crypto Derivatives Exchange". Continuous threat‑intel feeds should be consulted for any new indicators tied to the associated IP range or the registrar Gname.com Pte. Ltd., as adversaries frequently recycle these assets for subsequent campaigns.