cr7coin[.]life

The domain cr7coin.life was observed active on July 12, 2026 and is classified as a generic phishing threat with a high risk rating. The only page element disclosed by passive observation is the title string "Just a moment...", which provides no direct indication of the targeted brand or credential collection method.

Infrastructure analysis shows that the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted behind Cloudflare’s network. Authoritative name servers are iris.ns.cloudflare.com and wilson.ns.cloudflare.com, and DNS resolution points to IP address 104.21.95.177. The IP belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. TLS termination is performed by a certificate issued by Google Trust Services under the WE1 label, and the service advertises support for HTTP/3. An HTTP request to the root URL returns a 403 status code, suggesting that the front‑end may be guarded by access controls or bot‑challenge mechanisms.

Detection telemetry indicates that the domain is currently blocked by PhishDestroy and appears on a single security blocklist. VirusTotal’s scan results show a single positive detection out of ninety‑five antivirus engines, reinforcing the notion that the site is recognized as malicious by at least one vendor. The presence of Cloudflare and HTTP/3 technologies is consistent with the observed infrastructure but does not, by itself, confirm malicious intent.

Defenders should prioritize adding cr7coin.life to local and network‑wide blocklists, monitor its DNS records for any changes, and consider routing traffic to a sinkhole for further forensic capture. Continuous observation is recommended because the precise phishing kit, target audience, and content beyond the title remain unverified. Further passive and active analysis, when safe, may reveal additional indicators such as payload URLs, credential‑stealing forms, or redirection patterns that can enrich detection signatures.