keke-the-frog[.]ai-cryptolist[.]com

This domain, keke-the-frog.ai-cryptolist.com, is actively flagged as a high-risk seed phrase phishing site. Analysis indicates the domain was registered on April 11, 2026, through Key-Systems GmbH, a registrar commonly associated with phishing infrastructure. The domain resolves to the IP address 188.114.96.3, which is hosted on Cloudflare’s network in Canada, a frequent choice for threat actors due to its privacy and proxy services. The nameservers, aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com, further confirm Cloudflare’s role in the domain’s resolution. The site returns an HTTP 302 redirect status, a behavior often used to obscure the final phishing destination or to evade automated detection. The page title, 'Just a moment...', is consistent with Cloudflare’s interstitial pages, suggesting the domain may be leveraging Cloudflare’s security features to mask its true content. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which does not mitigate the domain’s malicious intent but does indicate encrypted communication. Detection data reveals the domain is currently listed on one security blocklist, with 18 of 94 vendors on a widely used threat intelligence platform flagging it as malicious. The phishing kit in use is identified as a seed phrase phishing tool, targeting cryptocurrency users by attempting to harvest private wallet recovery phrases. No specific brand impersonation is confirmed in the available data, and the exact content of the phishing page remains unanalyzed. Defenders should treat this domain as active and high-risk. The use of Cloudflare infrastructure, combined with the seed phrase phishing classification, suggests a targeted campaign against cryptocurrency holders. Network-level blocking of the IP 188.114.96.3 and domain-level filtering are recommended. Further monitoring of associated infrastructure, including the registrar and nameservers, may reveal additional related domains.