voovo-app[.]next-cryptolist[.]net

This report concerns the domain voovo-app.next-cryptolist.net, which is currently active and assessed as high risk due to involvement in seed phrase phishing. The domain was registered on April 11, 2026, via Key-Systems GmbH and presently resolves to IP address 172.67.181.166. Analysis of the infrastructure indicates the use of Cloudflare (with HTTP/3 enabled), Vue.js, and IPFS, suggesting an attempt to leverage modern web technologies and distributed hosting. The page displays the title 'CRYPTOLIST' and has been identified as deploying a 'Seed Phrase Phishing' kit, indicating a direct threat to users of cryptocurrency platforms. The SSL certificate is issued by Google Trust Services, providing a valid HTTPS connection, which may be used to increase credibility with potential victims. Security intelligence shows that this domain is currently blocked by at least one major anti-phishing service and appears on one security blocklist. VirusTotal reports that 17 out of 95 security vendors have flagged the domain, providing further evidence of malicious activity. The site has a Gridinsoft trust score of 0/100, reinforcing the assessment of high risk. At this time, the specific content of the phishing pages has not been independently verified, but the combination of a seed phrase phishing kit and the domain's characteristics strongly suggest it is designed to harvest sensitive information from cryptocurrency users. Defenders are advised to block this domain at the network perimeter, monitor for related infrastructure, and update threat intelligence feeds accordingly. Continued monitoring is recommended due to the domain's ongoing active status.