xrp-peanut[.]ai-cryptolist[.]net

This domain, xrp-peanut.ai-cryptolist.net, is identified as a cryptocurrency-focused phishing site designed to harvest user credentials, private keys, or wallet recovery phrases. Analysis indicates the domain mimics legitimate cryptocurrency platforms, likely leveraging social engineering tactics to deceive victims into entering sensitive information. The page title 'Just a moment...' suggests the use of a cloud-based security service to filter or redirect traffic, a common technique in phishing infrastructure to evade detection or delay analysis. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on April 11, 2026, through Key-Systems GmbH, with a creation date significantly in the future, a red flag for suspicious or automated registration. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain resolves to IP address 172.67.198.248, hosted behind a content delivery network, and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Users who visited xrp-peanut.ai-cryptolist.net should assume their credentials or cryptocurrency wallet details may have been compromised. Immediate actions include revoking access to any associated accounts, rotating passwords for linked services, and monitoring for unauthorized transactions. If cryptocurrency wallets were accessed, users should transfer assets to a new wallet and review all connected applications for suspicious permissions. System scans for malware are recommended, as phishing sites often deploy additional payloads. Network-level blocking of the domain and its resolving IP should be implemented to prevent further exposure.