telegram-girlfrined-ai[.]chat

This domain, telegram-girlfrined-ai.chat, is actively flagged as a high-risk crypto scam impersonating Ethereum infrastructure. Analysis indicates the domain resolves to IP 104.21.30.249, hosted on Cloudflare's network (AS13335) in the United States. The domain's nameservers (mcgrory.ns.cloudflare.com, kelly.ns.cloudflare.com) and SSL certificate (Google Trust Services / WE1) align with Cloudflare's standard configuration, which is frequently leveraged by threat actors to obscure origin servers and evade takedowns. Registration details point to Devexpanse Ltd (d/b/a Regery.com), a registrar previously associated with domains involved in fraudulent schemes. The page title, 'AI Girls for Telegram — Flirty Virtual Girlfriends, Always Online,' does not directly reference Ethereum or cryptocurrency, but the domain is explicitly classified as a crypto scam targeting Ethereum users. This discrepancy suggests the site may employ social engineering tactics, such as enticing users with deceptive services before redirecting or soliciting cryptocurrency transactions. One of 95 security vendors on VirusTotal has flagged the domain, and it appears on a single security blocklist, indicating limited but confirmed detection. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activity is prohibited or monitored. Given the domain's active status and Cloudflare hosting, takedown efforts may require direct engagement with the registrar or Cloudflare's abuse channels. Further investigation into associated wallet addresses or transaction patterns is recommended to identify broader campaign infrastructure. The exact content and delivery mechanism of the scam remain unconfirmed, but the domain's classification as a crypto scam warrants immediate containment measures.