socialgrowai[.]ai-cryptolist[.]net

Analysis of socialgrowai.ai-cryptolist.net shows a high‑risk, active brand‑impersonation campaign targeting Cloudflare. The domain resolves to IP 172.67.198.248, an address owned by Cloudflare, Inc. and located in Canada. DNS records indicate registration through Key-Systems GmbH and the use of Cloudflare’s authoritative nameservers melissa.ns.cloudflare.com and miles.ns.cloudflare.com. The domain was created on 2026‑04‑11 and serves an HTTPS site signed by a Google Trust Services / WE1 certificate, which is consistent with legitimate Cloudflare‑managed TLS but does not guarantee content integrity. The HTTP response is a 403 status code, and the page title returned is "Suspected Misleading Website | Cloudflare," confirming the intent to masquerade as a Cloudflare‑related resource. Security telemetry shows the site is blocked by PhishDestroy, appears on one security blocklist, and receives a Gridinsoft trust score of 0 / 100. VirusTotal scans report 16 of 94 vendors flagging the domain, reinforcing the malicious assessment. While the infrastructure (Cloudflare IP, legitimate TLS) may obscure attribution, the combination of brand‑impersonation cues, blocklist presence, and vendor detections indicates a credential‑phishing or crypto‑scam operation. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the associated IP and nameservers, and advise users that any request for Cloudflare credentials originating from this domain is fraudulent. Further investigation of the site’s payload, if any, is required to determine the exact phishing vector.