jinpeng[.]next-cryptolist[.]net

This domain was registered on April 11, 2026 via Key-Systems GmbH and resolves to 104.21.64.107, an IP owned by Cloudflare, Inc. in Canada. The authoritative nameservers are hunts.ns.cloudflare.com and nena.ns.cloudflare.com, indicating the infrastructure is hosted behind Cloudflare and serves traffic over HTTP/3. An HTTP request returns status 403, suggesting the site is actively serving content but denies direct access. The SSL certificate is issued by Google Trust Services under the WE1 trust anchor, confirming a valid TLS endpoint. Threat intelligence classifies the site as a high‑risk crypto drainer that employs a seed‑phrase phishing kit. VirusTotal records show 19 of 94 scanning engines flag the domain, and Gridinsoft assigns a trust score of 0/100. The domain appears on one external blocklist and is already blocked by PhishDestroy. Current status is active. No public page content or brand targeting has been disclosed, so the exact phishing lure remains unknown. Defenders should treat the domain as malicious: block DNS resolution and HTTP traffic, add the IP and domain to network deny lists, monitor for any outbound connections to the IP, and ensure endpoint protections flag any attempts to load the seed‑phrase kit. Continued observation is advised to capture any evolving payloads or victim interaction.