kontos[.]ai-cryptolist[.]net

This domain, kontos.ai-cryptolist.net, is flagged as a cryptocurrency-themed phishing resource targeting users through deceptive wallet or exchange credential harvesting. Analysis indicates no direct association with known drainer kits or legitimate cryptocurrency platforms, though the inclusion of 'ai-crypto' in the subdomain suggests an attempt to exploit interest in AI-driven investment schemes. The infrastructure lacks overt branding, reducing immediate attribution but increasing the likelihood of generic credential theft or fraudulent token distribution scams.

Technical indicators reveal the domain was registered on April 11, 2026, through Key-Systems GmbH, an uncommonly future-dated creation timestamp that may indicate typosquatting or domain pre-registration abuse. It resolves to IP address 104.21.68.219, a Cloudflare proxy endpoint, obscuring the true hosting origin. The domain is detected by 17 out of 95 security engines on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and uses a Google Trust Services SSL certificate, which provides HTTPS legitimacy without guaranteeing site safety. Google Safe Browsing status is not explicitly provided, but the presence of a single blocklist entry aligns with the elevated risk classification.

As of the latest verification, kontos.ai-cryptolist.net has been taken offline, likely due to enforcement actions or hosting provider intervention. The domain remains in a deactivated state, reducing immediate user exposure. However, residual risk persists due to the future-dated registration, which may allow the threat actor to reactivate the domain at a later date. Organizations should monitor for DNS reactivation or re-registration under similar naming conventions. Users are advised to verify cryptocurrency-related domains through official sources and avoid interacting with sites lacking verifiable ownership or transparent operational history.