slof[.]ai-cryptolist[.]org

This domain is flagged for elevated-risk generic phishing activity targeting cryptocurrency users. Analysis indicates it operates as a fraudulent wallet interface, designed to harvest private keys or seed phrases under the guise of legitimate crypto asset management services. The threat type aligns with credential theft and unauthorized transaction initiation, a common vector in cryptocurrency fraud schemes. Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3 and was registered through Key-Systems GmbH on April 11, 2026. Security vendor assessments show 17 out of 95 detection engines on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on two security blocklists and is blocked by PhishDestroy and OISD. Technical indicators include the use of Cloudflare for hosting, IPFS for content distribution, Vue.js for frontend development, and HTTP/3 for network communication. The SSL certificate is issued by Google Trust Services, and the page title consistently displays 'Just a moment...' during initial access attempts. Mitigation steps for this threat type include immediate blocking of the domain and associated IP at network perimeter devices. Security teams should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate fingerprint across endpoint protection and SIEM systems. User awareness training should emphasize verification of wallet interfaces through official sources, particularly for domains created recently (post-2024) or using cryptocurrency-related terms in subdomains. Network monitoring should focus on outbound connections to 188.114.96.3 and related Cloudflare IP ranges, with particular attention to HTTP/3 traffic patterns that may bypass traditional inspection methods. Incident response procedures should include checking for unauthorized cryptocurrency transactions following exposure to this domain.