fragma[.]next-cryptolist[.]net

The domain fragma.next-cryptolist.net has been identified as a generic phishing threat, specifically a crypto drainer designed to steal cryptocurrency wallets and login credentials. The site is currently offline, having been taken down after being flagged by security researchers. While it does not impersonate a specific well-known brand, its structure suggests it targets users of various crypto platforms.

Technical analysis reveals that fragma.next-cryptolist.net resolves to IP address 172.67.181.166 and was created on April 11, 2026, a recent date consistent with malicious intent. The domain was registered through Key-Systems GmbH and uses an SSL certificate issued by Google Trust Services / WE1. It appears on 1 security blocklist, and VirusTotal reports that 13 out of 95 security vendors flag this domain as malicious, indicating moderate consensus in the security community.

At present, the domain is offline, reducing immediate risk to users. However, PhishDestroy recommends that users who may have visited the site or entered any credentials should change their passwords immediately and enable two-factor authentication on all crypto-related accounts. Always verify the legitimacy of crypto platforms by checking official URLs and using trusted security tools like PhishDestroy to avoid falling victim to similar threats in the future.