app[.]lite-crv[.]cfd

The domain app.lite-crv.cfd was registered on 11 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Its authoritative name servers are ullis.ns.cloudflare.com and vick.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. DNS resolution points to the IP address 188.114.96.3, a host that is part of a Cloudflare edge network and is commonly leveraged by malicious actors to obscure the true origin of traffic. Multiple threat‑intel providers have already flagged the domain. PhishDestroy, MetaMask and SEAL list it as hostile, and it appears on three public blocklists.

VirusTotal scans show that seven out of ninety‑one security vendors have raised a detection, reinforcing the suspicion of malicious use. The current risk rating is elevated and the operational status is active, suggesting ongoing exploitation. No public evidence of SSL certificate details, HTTP response codes, or page title information is available in the shared intelligence, so the exact content served by the site remains unverified. Likewise, Safe Browsing, OTX, and other reputation services have not been reported for this domain.

The lack of visible content analysis limits the ability to confirm the precise phishing vector, but the convergence of registrar data, Cloudflare hosting, vendor detections, and blocklist entries provides a strong indication of a phishing infrastructure. Defenders should add app.lite‑crv.cfd to network‑level deny lists, update DNS filtering feeds, and consider sinkholing the associated IP address if feasible. Continuous monitoring of the domain’s DNS records and any changes in detection counts is recommended, as Cloudflare‑hosted domains can be repointed quickly. Integration of the domain into threat‑intel platforms will help correlate future activity with observed malicious campaigns.