crypto-to-bank[.]com

Analysis of the domain crypto-to-bank.com, registered on December 18, 2025, indicates a high-risk crypto scam targeting Ethereum users. The domain remains active as of July 23, 2026, with an HTTP status of 200, suggesting a functional web presence. Infrastructure analysis reveals hosting behind Cloudflare (AS13335) at IP 172.67.133.8, with nameservers braden.ns.cloudflare.com and jasmine.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious sites leveraging Cloudflare's proxy services. The page title, 'Crypto to Bank instant Transfer instant Exchange Crypto to Fiat Cash,' explicitly references crypto-to-fiat conversion, aligning with the scam type classified as a 'Crypto Scam' in threat intelligence sources.

The domain is flagged by 14 of 93 security vendors on VirusTotal, though this does not represent a full consensus. It appears on four security blocklists and is blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX lists the domain in three threat intelligence pulses, further corroborating its malicious classification. Scamadviser and Gridinsoft both assign a trust score of 1/100 and 0/100, respectively, indicating negligible legitimacy. MX records point to _dc-mx.28c2c24c7ca7.crypto-to-bank.com, a non-standard configuration that may facilitate phishing email campaigns.

Technologies detected on the site include Google Maps, Bootstrap, Unpkg, OWL Carousel, jQuery, cdnjs, and HTTP/3, which are common in both legitimate and malicious sites but offer no definitive indication of intent. Defenders should treat this domain as confirmed malicious. Block access at the network level, monitor for connections to 172.67.133.8 or related Cloudflare IPs, and alert users to the Ethereum impersonation risk. The domain's registration through NameSilo, LLC, provides no additional context for mitigation but may assist in tracking related infrastructure.