ghibli-kapibala[.]entry-cryptolist[.]app

The domain ghibli-kapibala.entry-cryptolist.app is currently classified as a high-risk generic_phishing infrastructure. It was created on 11 April 2026 via Key-Systems LLC and is hosted behind Cloudflare (IP 188.114.96.3, located in Canada). The domain resolves to Cloudflare’s network and uses nameservers fattouche.ns.cloudflare.com and liv.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, but the HTTP response returns 403, indicating the site is actively serving malicious content despite the denial. The infrastructure has been blocked by PhishDestroy and appears on one public blocklist; Gridinsoft assigns a trust score of 0/100. Ten of ninety-four VirusTotal scanners have flagged the host, reinforcing the suspicion. The campaign is associated with a Seed Phrase Phishing kit and is labeled as a “Fake Exchange” scam, suggesting attempts to harvest cryptocurrency seed phrases. No page content has been publicly disclosed, so the exact lure and credential-capture mechanisms remain unverified. Defenders should add the domain and its IP to blocklists, enforce DNS filtering, and monitor for related sub-domains or similar certificate issuances. Ongoing telemetry collection is recommended to confirm the kit’s payload and to identify any additional command-and-control endpoints.