vert-wallet-clarity[.]lovable[.]app

The domain vert-wallet-clarity.lovable.app was observed on July 12, 2026 as an active high‑risk site engaged in brand impersonation targeting Discord. The site returns HTTP 200 and presents the page title “Electrum VTC – Lightweight Vertcoin Wallet,” which does not reference the advertised brand, indicating a possible credential‑harvesting or social‑media lure. The unique seed 2827d4 ties this observation to internal tracking.

Infrastructure analysis shows the domain resolves to IP address 185.158.133.1, hosted within the Cloudflare network (AS13335) and geolocated to Poland. Registration is handled by Cloudflare, Inc., and the authoritative nameservers are ivan.ns.cloudflare.com and rafe.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 label, and HTTP Strict Transport Security is enforced, confirming the use of standard security mechanisms.

Threat intelligence flags indicate the site impersonates Discord, classified as a social_media scam. The Gridinsoft trust score of 0 / 100 reflects a malicious reputation. VirusTotal reports a single detection out of ninety‑five scanners, and the domain appears on one external blocklist. PhishDestroy has already added the domain to its blocklist, suggesting that defensive communities have recognized its malicious intent.

Defenders should block the domain and its resolving IP at perimeter and DNS filtering layers. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, as the infrastructure can be rapidly repurposed. Analysts should also inspect any traffic that presents the “Electrum VTC – Lightweight Vertcoin Wallet” title for potential credential capture attempts, and update detection signatures to include the observed nameserver and certificate attributes.