https://www.loveandgifts.com/
172.67.182.88 · Cloudflare, Inc.
Toronto, Canada
4266 days
403 · 20.3s
Valid· E7, Let's Encrypt, US
COMPLETED
Registered-domain escalation
Submit loveandgifts.com as the primary IOC, enriched with evidence from hostile subdomains like www.loveandgifts.com.
No KB/IOK detections were recorded for this scan.
Scanner blocked by cloudflare
This scan likely captured a block/challenge page, so the AI analysis may not reflect the real site victims see.
E-Commerce · 4/15/2026
The domain ATO resolves to a Cloudflare-protected site that presents a Cloudflare phishing warning page to scanners. The page content captured is a WAF/scan-block page rather than a genuine brand interface. Network requests show Turnstile integration and phish-bypass endpoints on Cloudflare infrastructure, with a 403 status and scanner-block context observed. No definitive credential harvesting UI or login form was observed in the captured content, but the domain appears to be attempting to bypass security checks, which is consistent with anti-scan evasion behavior.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 12
Hosts: 2
Domains: 2
Suspicious Endpoints
hxxps://www[.]loveandgifts[.]com/cdn-cgi/phish-bypass
The scan indicates the operator uses anti-bot protections and a Cloudflare phishing-warning page, which is a strong signal of deliberate evasion. The domain is publicly resolvable and has a valid SSL cert recently issued, but the actual phishing content could not be accessed due to the WAF block. The presence of phish-bypass endpoints and Turnstile integration suggests potential intent to gate access to a phishing surface; however, the captured content is a block page, not a credential-collection page. Recommend monitoring and further investigation to determine if the domain hosts a phishing surface when not blocked by WAF.
Monitor