i-protocol-v3[.]app

The domain i-protocol-v3.app was observed in a brand‑impersonation campaign targeting the cryptocurrency platform Sei. Infrastructure analysis shows the domain resolves to the IP address 104.21.30.224, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration details indicate the domain was provisioned through Cloudflare’s registrar service, and the authoritative name servers are liz.ns.cloudflare.com and woz.ns.cloudflare.com. No SSL certificate was presented at the time of observation, resulting in an unencrypted HTTP endpoint.

The Gridinsoft trust score assigned to the domain is 0 out of 100, reflecting an extremely low credibility rating. VirusTotal scans recorded two detections out of ninety‑five participating security vendors, confirming that at least a minority of scanners flag the domain as malicious. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. Evidence confirms the domain’s intent to impersonate Sei, as indicated by the classified scam type “Brand Impersonation.” However, the public page content, HTTP response codes, and Safe Browsing status have not been disclosed, leaving those vectors unverified.

Likewise, no Open Threat Exchange (OTX) identifiers or known phishing kits were identified in the available intelligence. Defenders should prioritize adding the domain and its associated IP address to network‑level blocklists, enforce TLS inspection to capture any future encrypted traffic, and monitor for any newly observed aliases that resolve to the same Cloudflare IP range. Continuous re‑evaluation of VirusTotal and other sandbox results is recommended, as additional detections may emerge. Given the low trust score, lack of certificate, and confirmed brand‑impersonation intent, the domain should be treated as a high‑confidence malicious artifact until proven otherwise.