kiboshib[.]ai-cryptolist[.]net

This domain, kiboshib.ai-cryptolist.net, is actively flagged as a high-risk phishing site targeting cryptocurrency users through seed phrase theft. Registered on April 11, 2026, via Key-Systems GmbH, the domain resolves to IP 172.67.198.248, hosted behind Cloudflare infrastructure in Canada. Analysis indicates the use of a known phishing kit specifically designed for seed phrase harvesting, aligning with the observed page title 'Just a moment...' and HTTP 302 redirect behavior. The domain is currently blocked by at least one security vendor and appears on one security blocklist, with 17 of 94 vendors on VirusTotal flagging it as malicious. Cloudflare nameservers (melissa.ns.cloudflare.com, miles.ns.cloudflare.com) and Google Trust Services SSL certificate (WE1) are in use, alongside HTTP/3 protocol detection. Defenders should treat this domain as confirmed malicious infrastructure. The 302 redirect suggests it may serve as a gateway to further phishing pages rather than hosting the final payload directly. Given the domain's recent registration and active status, monitoring for related subdomains or newly registered lookalike domains under the ai-cryptolist.net parent may be warranted. No specific brand impersonation is confirmed beyond the seed phrase phishing classification, and the exact content of the phishing pages remains unanalyzed. Immediate blocking at the DNS or network level is recommended, with additional scrutiny for any outbound connections to this domain from internal systems.