coti-ai-agents[.]ai-cryptolist[.]net

The domain coti-ai-agents.ai-cryptolist.net is identified as a crypto-focused phishing site, specifically designed to impersonate cryptocurrency agent services. Analysis indicates this domain is currently offline, though it previously hosted malicious content targeting users of digital asset platforms. The threat type is classified as a generic phishing scheme with a focus on cryptocurrency fraud, likely involving credential harvesting or wallet-draining tactics. Infrastructure analysis reveals the domain was created on April 11, 2026, and registered through Key-Systems GmbH. It resolves to the IP address 104.21.68.219 and holds an SSL certificate issued by Google Trust Services. Security vendors on VirusTotal flagged this domain at a rate of 17 out of 95, while it appears on one security blocklist. The Gridinsoft trust score for this domain is 0 out of 100, further confirming its malicious nature. The page title captured during analysis was 'Just a moment...', a common placeholder used during active phishing operations or while evading detection. As of the latest assessment, the domain has been taken offline, reducing immediate risk to users. However, organizations and individuals are advised to block the domain and its associated IP address (104.21.68.219) at the network level to prevent potential re-emergence. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range. Users who may have interacted with this domain should revoke any active sessions, reset credentials, and inspect their cryptocurrency wallets for unauthorized transactions.