christ-is-king[.]ai-cryptolist[.]org

This domain, christ-is-king.ai-cryptolist.org, is identified as a credential theft operation targeting cryptocurrency users through social engineering tactics. Analysis indicates the infrastructure mimics faith-based crypto investment platforms, likely to exploit trust and urgency around religious-themed financial promotions. No direct evidence of a crypto drainer kit was observed, but the domain structure and naming convention align with known credential harvesting campaigns in the blockchain space. Technical indicators confirm elevated risk: the domain is flagged by 17 out of 95 security vendors, registered through Key-Systems GmbH on April 11, 2026, and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate. The domain appears on two security blocklists, including PhishDestroy and OISD, and displays a generic 'Just a moment...' page title, often associated with cloaking or proxy-based evasion techniques. Current status shows the domain as offline, though historical DNS records and certificate transparency logs suggest prior active exploitation. Response actions include blocklisting by multiple threat intelligence feeds, but residual risk remains due to potential re-registration or IP reuse. Users are advised to verify wallet addresses independently, avoid clicking links from unsolicited messages, and monitor for unauthorized transaction attempts. Organizations should update firewall rules to block the IP and domain, and review logs for prior connections to 188.114.97.3.