glucose[.]next-cryptolist[.]net

Analysis of glucose.next-cryptolist.net indicates active brand impersonation targeting Cloudflare. The domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to IP address 104.21.64.107. Security vendors have flagged this domain, with 19 of 95 engines on VirusTotal detecting malicious activity. The page title, 'Suspected Misleading Website | Cloudflare,' explicitly references Cloudflare, reinforcing the brand impersonation classification. Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist, with PhishDestroy currently blocking it. The SSL certificate is issued by Google Trust Services, which is not inherently suspicious but does not mitigate the domain's malicious indicators. While the infrastructure remains active as of July 12, 2026, no further details about the phishing kit, payload delivery mechanism, or specific attack vector are available from the provided data. Defenders should treat this domain as high-risk and prioritize blocking or monitoring access to it. Additional investigation into the hosting infrastructure and associated domains may reveal broader campaign patterns, but no direct links to other known threats have been confirmed at this time.