superfruits-ai[.]ai-cryptolist[.]com

The domain superfruits-ai.ai-cryptolist.com is currently active and returns an HTTP 302 response, directing visitors to a page whose title is reported only as “Just a moment…”. The site is served over TLS using a Google Trust Services certificate issued by WE1, and its authoritative name servers are aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com, indicating Cloudflare’s CDN. DNS resolution points to IP 188.114.96.3, a Cloudflare‑owned address located in Canada. Registration occurred on 11 April 2026 through Key‑Systems GmbH. Automated analysis identifies the use of IPFS, Vue.js, Cloudflare and HTTP/3, and attributes the page to a “Seed Phrase Phishing” kit classified as brand impersonation. VirusTotal records show 18 of 94 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100 and PhishDestroy has already added the site to its blocklist; the domain appears on one additional blocklist. Concrete evidence therefore confirms malicious infrastructure and a high‑risk rating. The exact brand being spoofed, the content of the landing page, and any credential‑capture mechanisms remain unverified because the page has not been manually inspected. Defenders should immediately block the domain at network perimeter and DNS resolvers, add the IP address to threat‑intel feeds, monitor for similar Cloudflare‑hosted IPFS deployments, and continue to observe any changes in the redirect target. Ongoing inspection of the redirected URL is recommended to determine the full scope of the phishing campaign.