eco-ai[.]ai-cryptolist[.]com

On July 12, 2026, the domain eco-ai.ai-cryptolist.com was observed in an active generic_phishing campaign. The threat is classified as high risk based on its recent creation date (April 11, 2026) and the presence of a functional SSL certificate issued by Google Trust Services.

Infrastructure analysis shows the domain is registered through Key-Systems GmbH and uses Cloudflare authority for DNS resolution, specifically aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com. The authoritative A record points to 188.114.97.3, an IP address owned by Cloudflare, Inc. and located in Canada. The site returns HTTP 403, indicating that content is presently restricted but the endpoint remains reachable.

Reputation data is limited but notable. VirusTotal reports a single detection out of ninety‑five scanned security vendors, suggesting that most scanners have not yet identified malicious behavior. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external blocklist. PhishDestroy has already blocked the domain, confirming its association with phishing activity.

Defenders should proactively block eco‑ai.ai‑cryptolist.com at the DNS and proxy layers, and consider blacklisting the associated IP 188.114.97.3, especially for traffic destined to the Cloudflare edge. Continuous monitoring of TLS certificates issued by Google Trust Services for this domain is advised, as any change may indicate a shift in campaign tactics. Organizations are encouraged to feed any observed payloads or URL patterns to shared intelligence feeds to improve detection coverage.