bunnie[.]next-cryptolist[.]net

bunnie.next-cryptolist.net is currently flagged as a credential‑phishing site employing a seed‑phrase phishing kit. The domain was registered on 11 April 2026 through Key‑Systems GmbH and is hosted behind Cloudflare’s network, resolving to IP 172.67.181.166, which is geolocated to Canada. DNS is served by hunts.ns.cloudflare.com and nena.ns.cloudflare.com. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 root, indicating that encryption is in place despite malicious intent. HTTP requests return a 403 status, consistent with active blocking by security tools such as PhishDestroy, which has already listed the domain. VirusTotal scans show 19 of 94 security vendors flag the domain, and it appears on at least one external blocklist. The combination of recent registration, use of a known phishing kit, and multiple vendor detections supports a high‑risk assessment. Concrete payloads or page content have not been publicly disclosed, so the exact phishing flow remains unknown. Defenders should immediately block the domain at DNS and proxy layers, incorporate it into intrusion‑prevention and email‑filtering signatures, and monitor for any related C2 infrastructure or similar domains registered with the same registrar or nameservers.