alicius-muskimus[.]ai-cryptolist[.]net

PhishDestroy has opened a formal investigation into alicius-muskimus.ai-cryptolist.net after confirming it is actively impersonating a cryptocurrency investment or wallet platform. The domain’s name suggests a lure tied to well-known figures or projects. Security telemetry shows the site resolves to IP 172.67.198.248, which is associated with fast-flux hosting used to conceal backend infrastructure and prolong operation. At the time of analysis, VirusTotal registers zero detections among 95 engines, indicating it is not yet widely blacklisted despite clear red flags. This domain was registered on November 5 2025 through Key-Systems GmbH, a registrar known for both legitimate and abusive domains, suggesting opportunistic registration timing. The presence of a Google Trust Services SSL certificate is misleading: it does not validate the site’s legitimacy, only that a certificate was issued. The combination of a cryptocurrency-themed subdomain, recent creation, and low detection rate strongly indicates a targeted phishing campaign aimed at stealing private keys or login credentials from crypto investors. If you visited alicius-muskimus.ai-cryptolist.net, immediately disconnect from the site, close all browser tabs, and run a full antivirus scan. Do not enter any passwords, seed phrases, or wallet addresses. If you reused credentials elsewhere, reset those passwords and revoke API access to your crypto accounts. Report the domain to your antivirus vendor and to PhishDestroy via our submission portal. Monitor your wallet transactions for unauthorized transfers. Consider rotating all keys and enabling multi-factor authentication on all crypto services. Remain vigilant—this site may redirect to other phishing domains to harvest additional data.