rygarlyzdok-ai[.]live

The domain rygarlyzdok-ai.live operates as a fraudulent AI-assisted trading platform, specifically designed to deceive users into disclosing cryptocurrency credentials or transferring funds under false pretenses. Analysis indicates this is a crypto drainer phishing scheme, where victims are lured with promises of automated trading profits. The domain is currently offline, though prior activity suggests it may re-emerge under similar infrastructure. Infrastructure analysis reveals the domain was flagged by 9 of 95 security vendors on VirusTotal, indicating high confidence in its malicious nature. It was registered on May 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolved to IP address 104.21.40.117, which is part of a network known for hosting phishing and scam infrastructure. Additional technical indicators include the use of Cloudflare (including HTTP/3 and Browser Insights), jsDelivr, jQuery, and IPinfo, suggesting an attempt to mimic legitimate trading platforms. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, further confirming its fraudulent intent. The domain has been taken offline, though threat actors may attempt to revive the campaign using similar tactics or infrastructure. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users should be cautioned against interacting with unsolicited trading platforms, particularly those promising AI-driven financial returns. Security teams are recommended to monitor for newly registered domains under the same registrar or IP range, as threat actors often rotate infrastructure to evade detection. SSL certificates issued by Let’s Encrypt should not be considered a trust indicator, as they are frequently abused in phishing operations.