greenland-rare-bear[.]next-cryptolist[.]net

This domain, greenland-rare-bear.next-cryptolist.net, is flagged as a generic phishing site with a specific focus on cryptocurrency credential harvesting. Analysis indicates it operates as a crypto drainer, designed to trick users into disclosing wallet credentials or authorizing malicious transactions. The elevated risk level is justified by its active use in recent campaigns and technical infrastructure optimized for evasion. Infrastructure analysis reveals the domain resolves to IP 172.67.181.166 and employs Cloudflare for hosting, alongside HTTP/3 for encrypted communication. It is detected by 18 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain was registered on April 11, 2026, through Key-Systems GmbH, a registrar frequently abused for malicious operations. It appears on one security blocklist and is actively blocked by enterprise phishing detection systems. The SSL certificate is issued by Google Trust Services, adding a layer of legitimacy to deceive users. Mitigation requires immediate blocking of the domain and its associated IP (172.67.181.166) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) in endpoint detection systems to prevent access. Users who interacted with the domain must revoke any wallet authorizations granted during the session and monitor transaction histories for unauthorized activity. Security teams are advised to correlate logs for connections to 172.67.181.166 and inspect endpoints for signs of credential theft or malware execution. Given the domain's use of Cloudflare, additional scrutiny of encrypted traffic is recommended to identify related threats.