licko-2[.]ai-cryptolist[.]net

Analysis indicates that the domain licko-2.ai-cryptolist.net was registered on 11 April 2026 through Key-Systems GmbH. The domain resolves to 172.67.198.248, an IP owned by Cloudflare, Inc. in Canada, and uses Cloudflare’s own nameservers melissa.ns.cloudflare.com and miles.ns.cloudflare.com. An HTTPS endpoint presents a certificate issued by Google Trust Services under the WE1 root, confirming TLS termination but not validating the site’s legitimacy. HTTP requests return a 403 status code and the page title is "Suspected Misleading Website | Cloudflare", indicating an explicit claim of impersonating Cloudflare. The site is classified as a crypto‑related scam and is flagged by 18 of 94 security vendors on VirusTotal, receives a Gridinsoft trust score of 0/100, and is listed on at least one public blocklist, including PhishDestroy. The risk rating is high and the threat type is brand_impersonation. Current evidence does not reveal any additional infrastructure such as secondary IPs, hosting providers beyond Cloudflare, or observed malicious payloads. Defenders should block the domain at perimeter and DNS layers, monitor for connections to the associated IP, and consider adding the domain to internal blocklists. Ongoing observation is recommended to detect any changes in content or additional indicators that may emerge.