morelivingcafe[.]com

Analysis indicates that www.morelivingcafe.com is an active credential‑phishing site targeting users of online slot services. The domain was registered on 12 May 2022 through GoDaddy and is hosted behind Cloudflare, resolving to IP 104.21.73.159 located in Canada. DNS resolution uses Cloudflare authoritative nameservers fiona.ns.cloudflare.com and moura.ns.cloudflare.com, and the HTTPS certificate is issued by Google Trust Services (WE1), confirming proper TLS termination. HTTP requests receive a 301 redirect, and the page title captured from the live site reads “Vegas123 😏 Daftar dan Login Agen Slot88 Sekarang, Claim Bonus New Member Terbesar se Indonesia”, signalling an attempt to lure victims into a fake Slot88 login flow. Security telemetry shows a Gridinsoft trust score of 0/100 and two of 91 VirusTotal scanners flag the domain, leading to inclusion on at least one blocklist (PhishDestroy). The site employs common web technologies such as Stimulus, AMP, Google Analytics, Cloudflare Browser Insights, and HTTP/3, which are typical for fast‑loading phishing pages. No additional forensic artifacts, such as malware payloads or credential‑harvesting scripts, have been observed in the available data. Defenders should immediately block traffic to www.morelivingcafe.com and its associated Cloudflare IP range, update URL filtering rules, and monitor for similar Slot88‑related lure strings. Continuous scanning of the host IP for new malicious content is advised, as the infrastructure could be reused for additional campaigns.