rizznet[.]ai-cryptolist[.]net

The domain rizznet.ai-cryptolist.net was registered on April 11, 2026 through Key-Systems GmbH and resolves to the Cloudflare IP address 172.67.198.248, located in Canada. DNS resolution is handled by melissa.ns.cloudflare.com and miles.ns.cloudflare.com. An HTTPS connection is presented using a Google Trust Services / WE1 certificate, indicating a valid TLS chain. HTTP requests return a 302 redirect and the page title displayed is "Just a moment...", a common placeholder used by automated phishing kits. Threat intelligence ties the site to the Seed Phrase Phishing kit, a known vector for harvesting cryptocurrency recovery phrases. VirusTotal analysis shows 17 of 94 security vendors flag the domain as malicious, reinforcing the high‑risk assessment. The domain is listed on at least one security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of benign reputation. Current status remains active, and the infrastructure is fully cloud‑based via Cloudflare, which may obscure the origin of the operators. Defenders should add the domain to network deny lists, monitor DNS queries for the associated IP and nameservers, and enforce TLS inspection to capture the redirect behavior. Continued observation is advised to capture any evolution of the payload or additional infrastructure changes.