yod-agent[.]next-cryptolist[.]net

This domain, yod-agent.next-cryptolist.net, is actively flagged as a high-risk crypto scam targeting seed phrases. Analysis indicates it was registered on April 11, 2026, through Key-Systems GmbH and is currently resolving to Cloudflare infrastructure (IP 172.67.181.166, Canada). The domain is served via Cloudflare nameservers (hunts.ns.cloudflare.com, nena.ns.cloudflare.com) and employs HTTP/3, a protocol often used to evade detection. Its SSL certificate is issued by Google Trust Services (WE1), a common choice for malicious domains due to its free and automated issuance. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns it a trust score of 0/100, reinforcing its classification as malicious. While the exact content of the site remains unanalyzed, the provided intelligence specifies it as a 'Seed Phrase Phishing' scam, a type of attack designed to harvest cryptocurrency wallet recovery phrases. As of July 12, 2026, the domain returns an HTTP 403 status, which may indicate active blocking or a temporary takedown attempt, though it remains operational. Eighteen of 94 security vendors on VirusTotal flag this domain as malicious, providing further evidence of its threat status. Defenders should treat this domain as hostile and prioritize blocking it at the DNS, IP, and certificate levels. Given its association with Cloudflare, monitoring for new subdomains or rapid IP changes is recommended, as threat actors frequently rotate infrastructure to bypass mitigations. No legitimate use case is identified for this domain, and its registration age (three months) aligns with typical phishing lifecycle patterns.