lawn[.]ai-cryptolist[.]com

This domain, registered on April 11, 2026 through Key-Systems GmbH, is an active phishing site impersonating Cloudflare. The domain's nameservers (aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com) and IP address (188.114.97.3, located in Canada and belonging to Cloudflare, Inc.) leverage Cloudflare's own infrastructure, which is a known technique to evade initial inspection. The page title encountered is 'Suspected Misleading Website | Cloudflare,' and the server returns an HTTP 403 status, indicating the content is restricted or the site is behind Cloudflare's challenge page. The site is classified as a crypto drainer scam, meaning its likely goal is to trick visitors into connecting cryptocurrency wallets, leading to asset theft. The SSL certificate was issued by Google Trust Services (WE1). The domain appears on one security blocklist and is flagged by 19 out of 94 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain is blocked by PhishDestroy. Defenders should ensure this domain is added to blocklists, DNS filters, and email security gateways. Users who may have visited this site should be warned not to interact with any prompts, especially those requesting wallet connections or credentials. The exact landing page content has not been retrieved due to the 403 response, so the full attack vector is not yet confirmed, but the anti-virus signal and scam type classification provide strong evidence of malicious intent. No other brands, kits, or ASN details beyond Cloudflare's infrastructure are available in the data.