unitree-g1-ai[.]ai-cryptolist[.]org

Analysis of unitree-g1-ai.ai-cryptolist.org indicates an active crypto‑drainer infrastructure launched shortly after domain registration on 11 April 2026 through Key‑Systems GmbH. The domain resolves to 188.114.97.3, an IP owned by Cloudflare, Inc. in Canada, and the site is protected by Cloudflare services with HTTP/3 enabled and a Google Trust Services / WE1 TLS certificate. HTTP responses return a 302 redirect and the only observable page title is "Just a moment...", suggesting a staged redirection typical of credential‑harvesting flows. The phishing kit associated with the site is identified as Seed Phrase Phishing, aligning with the reported crypto‑drainer scam type, and 17 of 94 VirusTotal scanners have flagged the domain as malicious. The domain is already listed on a security blocklist and has been blocked by PhishDestroy, confirming its malicious intent. While the exact fraudulent landing page content has not been captured, the combination of a recent registration, Cloudflare‑hosted infrastructure, a known seed‑phrase phishing kit, and multiple vendor detections provide strong evidence of a high‑risk crypto‑draining operation. Defenders should continue to block the domain at network perimeter controls, monitor for outbound connections to the associated IP, and advise users to avoid any unsolicited requests for private keys or seed phrases. Ongoing intelligence collection should focus on identifying associated command‑and‑control endpoints and any downstream addresses used for fund extraction.