lisaloopcoin[.]digital

Analysis of lisaloopcoin.digital indicates a high‑risk phishing infrastructure that remains active as of the report date. The domain was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and immediately points to the IP address 104.21.26.160, which is owned by Cloudflare (AS13335) and located in the United States. DNS resolution is handled by the Cloudflare nameservers liv.ns.cloudflare.com and michael.ns.cloudflare.com, and the site is served over HTTP/3 with a TLS certificate issued by Let’s Encrypt (E7). An HTTP 403 response is observed, and the only visible page title is “Nur einen Moment…”.

The infrastructure is flagged by multiple reputation sources: Gridinsoft assigns a trust score of 0 / 100, the domain appears on three security blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records two positive detections out of ninety‑five scanners, reinforcing the malicious classification. The combination of Cloudflare front‑ending, a low‑trust score, and blocklist listings aligns with a generic phishing campaign targeting users who may be lured by the domain name’s reference to “coin”.

No additional content or payload details have been disclosed, so the exact phishing vector and victim profile remain uncertain. Defenders should treat lisaloopcoin.digital as malicious, add it to URL filtering and DNS block lists, monitor for any C‑name or IP re‑use within the Cloudflare network, and advise users to avoid any unsolicited requests that direct them to this domain. Ongoing telemetry collection is recommended to capture any future changes in hosting or page content.