ai99x[.]entry-cryptolist[.]app

PhishDestroy identifies ai99x.entry-cryptolist.app as an active cryptocurrency drainer domain currently under investigation for generic phishing. The site masquerades as a legitimate crypto-list service and is designed to trick users into connecting wallets or entering seed phrases; no specific brand or drainer kit has been publicly disclosed yet. Registrar data remains redacted, and the payload is delivered via the domain itself rather than a well-known drainer kit. This domain resolves to IP 188.114.97.3 and exhibits 0 detections out of 95 engines on VirusTotal at seed 593f22. It holds a Google Trust Services SSL certificate and is not currently flagged in Google Safe Browsing. Creation date and registrar details have not been released by the investigating team; consequently, blocklist coverage cannot be confirmed at this time. Current status is active with under-investigation risk. Response actions are ongoing and include takedown outreach to the hosting provider and SSL issuer. Remaining risk is elevated due to zero detections and the use of a trusted certificate authority, underscoring the need for users to verify domains before any cryptocurrency transaction.