bkok-fintech[.]ai-cryptolist[.]net

Analysis indicates that the domain bkok-fintech.ai-cryptolist.net is actively associated with a high-risk crypto seed phrase phishing operation. Registered on April 11, 2026, through Key-Systems GmbH, the domain currently resolves to a Cloudflare-hosted IP (172.67.198.248) located in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (melissa.ns.cloudflare.com, miles.ns.cloudflare.com) and HTTP/3 technology, alongside a Google Trust Services SSL certificate (WE1). The domain returns an HTTP 302 redirect status, a common tactic to obscure final landing pages from automated crawlers. The page title 'Just a moment...' aligns with Cloudflare interstitial pages, suggesting the site may be leveraging Cloudflare's protection to evade detection while redirecting victims to a seed phrase harvesting kit. This aligns with the classified phishing kit type (Seed Phrase Phishing) and the labeled scam category (Crypto Scam). As of July 12, 2026, the domain remains active and is flagged by 18 of 94 security vendors, though the exact content of the phishing pages has not been analyzed. It appears on at least one security blocklist and is blocked by PhishDestroy. Defenders should treat this domain as malicious infrastructure. The combination of Cloudflare hosting, a recent registration, and a known phishing kit seed indicates a deliberate attempt to target cryptocurrency users. Network-level blocking and monitoring for connections to 172.67.198.248 or the domain itself are recommended. Further investigation into associated wallet addresses or redirect chains may reveal additional compromised infrastructure.