spherex[.]next-cryptolist[.]net

This domain, spherex.next-cryptolist.net, is actively flagged as a high-risk brand impersonation targeting Cloudflare. Registered on April 11, 2026, through Key-Systems GmbH, the domain presents a page titled 'Suspected Misleading Website | Cloudflare' and returns an HTTP 403 status. Infrastructure analysis reveals the domain resolves to IP 172.67.181.166, hosted by Cloudflare, Inc. in Canada, and employs Cloudflare nameservers (hunts.ns.cloudflare.com, nena.ns.cloudflare.com) along with Cloudflare's reverse proxy and HTTP/3 support. The SSL certificate is issued by Google Trust Services (WE1). VirusTotal shows 18 of 94 security vendors flagging the domain as malicious, and it appears on one security blocklist. The domain is classified as a crypto drainer scam, a subcategory of phishing designed to steal cryptocurrency assets. Despite the 403 status, the domain remains active, indicating potential redirection or access controls that may limit visibility to external scanners. Defenders should block this domain at the network and email gateway levels, monitor for any associated subdomains or IP changes, and investigate possible connections to known crypto drainer kits. Users encountering this domain should be warned against interacting with it. Further analysis of the page content or redirect chain is advised to fully understand the threat actor's tactics. The Gridinsoft trust score of 0/100 reinforces the high-risk assessment.