metaiverse[.]ai-cryptolist[.]com

Analysis of the domain metaiverse.ai-cryptolist.com indicates active brand impersonation targeting Cloudflare, classified as a high-risk crypto scam. The domain was registered on April 11, 2026, through Key-Systems GmbH and currently resolves to the IP address 188.114.96.3, geolocated to Canada under Cloudflare, Inc. infrastructure. Nameservers are hosted on Cloudflare (aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com), a configuration consistent with both legitimate and malicious domains leveraging Cloudflare services for obfuscation or performance. The SSL certificate is issued by Google Trust Services (WE1), providing encrypted connections but offering no inherent trust validation regarding the domain's intent. The page title, 'Suspected Misleading Website | Cloudflare,' explicitly references Cloudflare, reinforcing the impersonation vector. While the HTTP status returns a 403 (Forbidden), this does not preclude the domain from serving malicious content under different paths or conditions. Security vendors have flagged the domain, with 18 of 94 engines on VirusTotal detecting it as malicious. It appears on at least one security blocklist and is blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. Technologies detected include Cloudflare and HTTP/3, aligning with the domain's hosting and network configuration. Defenders should treat this domain as confirmed malicious infrastructure. Blocking at the DNS or network level is recommended, particularly in environments where cryptocurrency-related scams pose a risk. The domain's association with Cloudflare nameservers does not imply endorsement or legitimacy, as threat actors frequently exploit reputable service providers to evade detection. Further monitoring is advised to track any shifts in hosting, content, or targeting patterns.