madsraffle[.]live

The domain madsraffle.live is currently offline but retains a set of observable infrastructure elements that warrant elevated risk classification. DNS resolution continues to point at 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative name servers, peyton.ns.cloudflare.com and veda.ns.cloudflare.com, are hosted by Cloudflare, confirming that the registration service also passed through the same provider.

No TLS certificate is presented for the host, indicating that the site was served over plain HTTP at the time of capture. The page title returned by the HTTP response was "Solandy Mad Raffle," and the site was identified as impersonating the Twitter brand to conduct wallet or seed phishing, a technique aimed at extracting cryptocurrency recovery phrases. VirusTotal recorded a single positive detection out of 95 scanning engines, and the domain is listed on two external security blocklists.

It has been actively blocked by PhishDestroy and ScamSniffer, and Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. While the offline status limits real‑time observation of payload delivery, the confirmed infrastructure, brand impersonation, and low trust metrics collectively suggest a purposeful attempt to harvest crypto wallet seeds. Defenders should ensure that the IP address 188.114.96.3 and the associated hostnames are added to network deny lists, monitor for any resurgence of activity, and reinforce user awareness about unsolicited requests for seed phrases, especially those masquerading as Twitter communications.