juniperfox-ai[.]ai-cryptolist[.]net

This domain, juniperfox-ai.ai-cryptolist.net, is actively flagged as a high-risk crypto drainer phishing site targeting cryptocurrency wallet seed phrases. Registered on April 11, 2026, through Key-Systems GmbH, the domain resolves to IP 172.67.198.248, hosted on Cloudflare infrastructure in Canada, and uses Cloudflare nameservers (melissa.ns.cloudflare.com, miles.ns.cloudflare.com). The site returns an HTTP 302 redirect status with a page title 'Just a moment...', a common indicator of intermediate or cloaked phishing pages. Analysis indicates the use of a 'Seed Phrase Phishing' kit, designed to harvest sensitive recovery phrases from victims, enabling unauthorized access to cryptocurrency wallets. Infrastructure analysis reveals the domain is currently active and appears on at least one security blocklist, with 17 of 94 security vendors on VirusTotal flagging it as malicious. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider often exploited by threat actors to lend credibility to phishing sites. Defenders should note the domain's reliance on Cloudflare, which may obscure origin server details and complicate takedown efforts. The scam type is explicitly classified as a crypto drainer, suggesting the primary objective is financial theft via compromised wallet credentials. No specific brand impersonation is confirmed from the available data, though the domain structure ('ai-cryptolist') may imply a focus on cryptocurrency-related services. The exact content and victim interaction flow remain unanalyzed, as the site has not been directly inspected. Defenders are advised to block the domain and associated IP at the network level, monitor for related subdomains or newly registered lookalike domains, and alert users to the risks of seed phrase exposure. Given the active status and high-risk classification, immediate containment is recommended.