redirect-to-loliita[.]network

Analysis of redirect-to-loliita.network indicates a high-risk phishing infrastructure still active as of July 12, 2026. The domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to 188.114.96.3, an IP address assigned to Cloudflare, Inc. in Canada. Nameservers autumn.ns.cloudflare.com and watson.ns.cloudflare.com confirm Cloudflare as the hosting provider, which is consistent with observed phishing campaigns leveraging CDN services to obscure origin servers and evade takedowns. The domain is flagged by 6 security vendors on VirusTotal and appears on at least one security blocklist. AlienVault OTX records show the domain in 8 threat intelligence pulses, suggesting it is part of an ongoing malicious redirect chain. The HTTP response code 403 and page title 'Just a moment...' are typical of Cloudflare-protected phishing gateways that filter direct access while allowing traffic from specific referrers or conditions. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious. No specific brand impersonation or scam type is confirmed from available data, and the exact content of the destination remains unanalysed. Defenders should treat this domain as an active phishing redirector and block both the domain and its resolved IP at the network level. Monitoring for inbound links or referrals to this domain is recommended to identify compromised endpoints or ongoing campaigns.