hachiko-token[.]ai-cryptolist[.]net

Analysis of hachiko-token.ai-cryptolist.net shows a newly created domain (registered 11 April 2026) hosted behind Cloudflare. The authoritative nameservers are melissa.ns.cloudflare.com and miles.ns.cloudflare.com, and the domain resolves to the Cloudflare IP 172.67.198.248, which is geolocated to Canada. TLS termination is provided by Google Trust Services under the WE1 certificate, and the site serves HTTP/3 traffic. An HTTP 302 redirect returns a page titled "Just a moment...", and the domain is currently flagged as active with a high risk rating. Intelligence sources indicate the site is being used for brand impersonation, classified as generic phishing, and it has been blocked by PhishDestroy. VirusTotal scans report 17 of 94 security vendors flag the domain, and it appears on one external blocklist; the Gridinsoft trust score is 0 / 100. While the exact phishing payload has not been publicly disclosed, the combination of a recent registration, Cloudflare obfuscation, a low trust score, and multiple vendor detections suggests a malicious intent. Defenders should add the domain and its resolving IP to outbound filtering rules, monitor DNS queries for the domain, and consider sinkholing traffic to prevent credential harvesting. Continuous re‑evaluation is advised as additional indicators may emerge.