api[.]ai-mining[.]ltd

The domain api.ai-mining.ltd was registered on March 24, 2026 through Namemart Limited and is currently listed as offline after being taken down. DNS resolution points to the Cloudflare edge address 188.114.97.3, which geolocates to California, United States, and the domain is served by Cloudflare nameservers dale.ns.cloudflare.com and sunny.ns.cloudflare.com. HTTP requests return a 500 status code and the only observed page title is "Attention Required! | Cloudflare," indicating that the site presented a Cloudflare challenge page rather than a legitimate landing page.

The TLS certificate is issued by Let’s Encrypt (certificate identifier E8), confirming the use of a free SSL certificate. Service fingerprints show Cloudflare Browser Insights and HTTP/3 support, consistent with standard Cloudflare hosting. Threat intelligence flags the domain as a banking phishing operation; three of ninety‑four VirusTotal scanners flagged the host, and the domain appears on one external security blocklist. PhishDestroy has also blocked the domain.

The risk rating is elevated, reflecting the combination of phishing classification, recent creation date, and active blocklist presence. While the exact phishing content and targeted financial institution are not disclosed in the available data, the evidence suggests an intent to harvest banking credentials. Defenders should add api.ai-mining.ltd to URL filtering and DNS blocklists, monitor for any re‑registration or associated subdomains, and enforce strict email and web gateway controls to mitigate potential credential harvesting attempts. Continuous monitoring of VirusTotal and other sandbox environments is recommended to capture any future payloads should the domain reappear.