ambient-agi[.]ai-cryptolist[.]net

PhishDestroy identifies ambient-agi.ai-cryptolist.net as an active crypto drainer domain designed to siphon cryptocurrency from unsuspecting victims. This malicious site masquerades under a spoofed 'AI-cryptolist' branding, leveraging the growing popularity of AI and cryptocurrency to deceive users into connecting their wallets or transferring funds. The domain appears to be part of a broader phishing campaign targeting crypto investors, with infrastructure tailored for on-chain data exfiltration and token stealing via fraudulent transaction approvals.

This domain was registered on November 05, 2025 through Key-Systems GmbH and resolves to IP address 172.67.198.248. Despite being only a month old, it has not triggered any detections across 95 VirusTotal scanners, indicating zero/95 coverage as of latest data. It holds a valid SSL certificate issued by Google Trust Services, likely to appear legitimate during HTTPS interactions. No current presence on Google Safe Browsing (GSB) lists was detected during analysis, and blocklist inclusion remains under review, offering minimal proactive defense.

Current status of ambient-agi.ai-cryptolist.net is classified as active and under investigation by security teams. PhishDestroy urges immediate network and DNS blocking to prevent access. Users should avoid accessing this domain and verify all wallet connections and transaction approvals with extreme caution. While the risk level is currently marked as under investigation, the absence of detections and short domain lifespan suggest a high potential for increased malicious activity. Proactive blocking and user awareness are strongly recommended to mitigate exposure.