moonpup[.]ai-cryptolist[.]com

This domain, moonpup.ai-cryptolist.com, is identified as a cryptocurrency-focused phishing site designed to harvest wallet credentials and sensitive user data. Analysis indicates the site employs a CRYPTOLIST-themed interface, likely mimicking legitimate cryptocurrency listing platforms to deceive victims into disclosing private keys or seed phrases. No explicit drainer kit signatures were observed, but the infrastructure aligns with common phishing tactics targeting digital asset holders. Infrastructure analysis reveals the domain was registered through Key-Systems GmbH on April 11, 2026, an anomalous creation date suggesting potential domain spoofing or typosquatting. It resolves to the IP address 188.114.97.3, a Cloudflare-protected endpoint utilizing HTTP/3 and IPFS for content delivery. Detection metrics include a VirusTotal score of 18/95 security vendors flagging the domain, a Gridinsoft trust score of 0/100, and presence on one security blocklist. The SSL certificate is issued by Google Trust Services, adding a layer of apparent legitimacy while obscuring malicious intent. The domain is currently offline, mitigating immediate risk to users. However, historical activity and infrastructure persistence warrant continued monitoring. Users who interacted with the site should revoke wallet permissions, rotate credentials, and audit connected applications for unauthorized access. The anomalous registration date and reliance on Cloudflare suggest potential for rapid redeployment under similar domains, maintaining an elevated residual risk.