just-a-chill-guy-ethereum[.]ai-cryptolist[.]com

Analysis indicates that the domain just-a-chill-guy-ethereum.ai-cryptolist.com was registered on 11 April 2026 through Key-Systems GmbH and is currently hosted on Cloudflare infrastructure (nameservers aragorn.ns.cloudflare.com, wanda.ns.cloudflare.com, IP 188.114.96.3, CA location). The site presents a HTTP 302 redirect and serves a page titled “Just a moment…”. SSL termination is provided by Google Trust Services under the WE1 certificate, confirming the presence of a valid TLS certificate. Threat intelligence classifies the site as a brand‑impersonation campaign targeting Ethereum, employing a known “Seed Phrase Phishing” kit. VirusTotal reports 18 of 94 security vendors flagging the domain, and it appears on a single external blocklist. The domain is already blocked by PhishDestroy and receives a Gridinsoft trust score of 0/100, indicating high malicious confidence. Current status is active. Defenders should immediately add the domain to deny‑list policies at DNS and web‑proxy layers, monitor for any outbound connections to the associated Cloudflare IP, and incorporate the observed HTTP 302 behavior and “Just a moment…” title into detection signatures. Continuous observation is advised to capture any evolution of the phishing kit or additional infrastructure changes, as further details about the landing page content remain unavailable.