lotusvest[.]com

Analysis of lotusvest.com indicates the domain is being used for a phishing campaign targeting victims with a generic lure. The site was registered on 2025-09-03 through the registrar Spaceship, Inc., and is currently hosted on Cloudflare’s network (ASN 13335) with the IPv6 address 2606:4700:3037::6815:2882. The domain resolves to Cloudflare edge infrastructure and does not present an SSL certificate, which is atypical for legitimate services but consistent with rapid‑deployment phishing infrastructure. Both name servers—bethany.ns.cloudflare.com and jarred.ns.cloudflare.com—are Cloudflare‑provided, confirming the hosting relationship. VirusTotal records show that 2 of 95 scanned security vendors flagged the domain, providing an early indication of malicious activity.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one third‑party sinkhole has taken mitigation steps. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation. The page title returned by the HTTP response is “Lotusvest”, but no further content has been captured because the site has been taken offline at the time of analysis. Uncertainties remain regarding the specific phishing vector, the credential collection mechanism, and whether the domain was part of a broader campaign employing additional domains. No evidence of a valid TLS certificate, brand impersonation, or malicious payload delivery has been observed, and no associated malware hashes or URL patterns are currently available.

Defenders should continue to block lotusvest.com at perimeter firewalls, DNS resolvers, and proxy filters. Monitoring of the associated IPv6 address and the Cloudflare name servers for future activity is advised, as threat actors frequently repurpose the same hosting assets.