rna[.]ai-cryptolist[.]com

The domain rna.ai-cryptolist.com is identified as a cryptocurrency-focused phishing endpoint targeting digital asset holders. Analysis indicates the site operated as a credential harvester and wallet-draining platform, designed to deceive users into disclosing private keys or transferring funds to attacker-controlled addresses. As of the latest assessment, the domain has been taken offline, though residual risks may persist through cached or mirrored copies. Infrastructure analysis reveals the domain was registered through Key-Systems GmbH on April 11, 2026, resolving to the IP address 188.114.96.3. It was flagged by 18 of 95 security vendors on VirusTotal, with detection engines classifying it as a generic phishing threat. The domain appeared on one security blocklist and employed Cloudflare for traffic obfuscation, alongside IPFS for decentralized hosting and Vue.js for frontend interactivity. The SSL certificate was issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious infrastructure. Current status confirms the domain is offline, though historical indicators remain relevant for threat correlation. Organizations and individuals are advised to block the domain and associated IP at perimeter defenses, revoke any credentials potentially exposed through interaction with the site, and monitor for secondary infections. End-users should verify domain authenticity before engaging with cryptocurrency-related platforms, particularly those employing decentralized hosting technologies or third-party CDNs.