ghibli-chad[.]next-cryptolist[.]net

This domain, ghibli-chad.next-cryptolist.net, is flagged as a generic phishing site specializing in cryptocurrency credential theft. Analysis indicates it likely operates as a wallet drainer, tricking users into submitting private keys or seed phrases under the guise of a legitimate crypto-related service. No direct brand impersonation is evident, but the domain structure mimics decentralized finance (DeFi) platforms to exploit user trust in blockchain ecosystems. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain resolves to IP address 104.21.64.107 and was registered on April 11, 2026, through Key-Systems GmbH. Security vendors flagged it in 19 out of 95 VirusTotal scans, while Gridinsoft assigned a trust score of 0/100. It appears on one security blocklist and is actively blocked by Google Safe Browsing. The SSL certificate, issued by Google Trust Services, further complicates detection by providing an illusion of legitimacy. Currently, ghibli-chad.next-cryptolist.net is offline, likely due to takedown efforts or operational rotation by threat actors. Despite its inactive status, residual risk persists for users who may have interacted with the domain prior to deactivation. Organizations should monitor for related indicators, including the associated IP and SSL certificate, in network logs. Users are advised to verify wallet addresses independently and avoid entering sensitive credentials on unfamiliar platforms, even those with valid SSL certificates.