alaya-ai[.]ai-cryptolist[.]net

This domain, alaya-ai.ai-cryptolist.net, is flagged as a high-risk generic phishing site. The site presents a 302 redirect and returns the page title "Just a moment...". Infrastructure analysis shows it resolves to 104.21.68.219, a Cloudflare-managed IP located in Canada. The domain is served with a Google Trust Services / WE1 SSL certificate, which may lend false legitimacy. Registration data indicates the domain was created on 2025-11-05 through Key-Systems GmbH and uses Cloudflare's Melissa and Miles nameservers. VirusTotal records show 2 of 94 security vendors have flagged the domain, and it is listed on the PhishDestroy blocklist. The observed phishing kit is identified as "Seed Phrase Phishing" and the campaign is categorized as a "Fake Exchange" operation, suggesting attempts to harvest cryptocurrency seed phrases from victims. Current evidence does not include a detailed page content review, so the exact user-facing experience remains unverified. Defenders should block the domain at the DNS and proxy layers, monitor for related C2 traffic, and consider adding the IP address to threat-intel feeds. Continuous observation is advised because the site remains active and may evolve its payload.