ski-mask-cat[.]ai-cryptolist[.]com

The domain ski-mask-cat.ai-cryptolist.com was registered on April 11, 2026 through Key-Systems GmbH and is hosted behind Cloudflare infrastructure (IP 188.114.97.3, CA location). authoritative nameservers aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com resolve to the same Cloudflare edge. The site presents a HTTP 302 redirect and serves a TLS certificate issued by Google Trust Services / WE1. The only observed page title is "Just a moment..."; no further content has been captured. Reputation data shows a Gridinsoft trust score of 0/100 and a VirusTotal detection rate of 18 out of 94 scanners, indicating a strong consensus that the domain is malicious. It is classified as a "Crypto Drainer" generic phishing campaign and is currently listed on one public blocklist. PhishDestroy has already blocked the domain. Risk is marked high and the status remains active. Defenders should immediately ingest the domain and its resolving IP into perimeter blocklists, enforce DNS sinkholing for the host, and monitor outbound traffic for connections to the Cloudflare edge IP. Because the page content is not yet analysed, additional inspection of the redirected landing page is recommended to verify any payload delivery mechanisms or credential‑stealing forms. Continuous re‑evaluation of the domain’s detection counts and blocklist presence is advised as threat actors may shift infrastructure or employ new delivery vectors.