lovecoin[.]ai-cryptolist[.]com

Analysis of the domain lovecoin.ai-cryptolist.com indicates active involvement in a cryptocurrency-related phishing campaign targeting seed phrases. The domain was registered on April 11, 2026, through Key-Systems GmbH and is currently resolving to the IP address 188.114.97.3, which is associated with Cloudflare infrastructure in Canada. The domain's nameservers (aragorn.ns.cloudflare.com and wanda.ns.cloudflare.com) further confirm its reliance on Cloudflare services, a common tactic to obscure hosting origins and evade takedowns. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate malicious activity but is frequently leveraged by phishing domains to appear legitimate. The domain is flagged by 19 of 94 security vendors on VirusTotal, suggesting moderate detection coverage, though this does not encompass all potential threats. It appears on at least one security blocklist, and its Gridinsoft trust score is 0/100, reinforcing its classification as high-risk. The HTTP status code 302 indicates a redirect, which is often used in phishing campaigns to funnel victims to malicious payloads or credential-harvesting pages. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, which may precede the actual phishing content. Infrastructure analysis reveals the use of HTTP/3, a protocol that can complicate traffic inspection and detection. The domain is explicitly linked to a 'Seed Phrase Phishing' kit, a specialized form of crypto scam designed to trick victims into divulging private wallet recovery phrases. Defenders should treat this domain as an active threat, particularly in environments where cryptocurrency transactions or wallet management occur. Immediate blocking at the DNS or network level is recommended, alongside monitoring for related indicators of compromise, such as outbound connections to 188.114.97.3 or associated Cloudflare IPs.