cryptogram[.]ae

Analysis of the domain cryptogram.ae, registered on 21 February 2026, shows active infrastructure supporting a crypto‑focused scam. The domain resolves to 172.67.179.228, an address owned by AS13335 (Cloudflare, Inc.) located in the United States. HTTP requests receive a 301 redirect, and the site presents a valid TLS certificate issued by Google Trust Services under the WE1 root, indicating that transport encryption is correctly configured. The page title returned by the server is “Cryptogram.vip — Bridge Between Crypto,” confirming the intent to lure victims with cryptocurrency‑related promises. Technical fingerprinting reveals a WordPress stack backed by MySQL, PHP, and LiteSpeed, with client‑side components including Swiper and Mailgun for email handling, as well as Google Analytics and HTTP/3 support.

Nameserver delegation points to dave.ns.cloudflare.com and zoe.ns.cloudflare.com, consistent with the Cloudflare hosting profile. Reputation services have flagged the domain. Two of ninety‑three VirusTotal scanners reported malicious behavior, and the domain appears on two known blocklists. PhishDestroy and ScamSniffer have already listed cryptogram.ae as a malicious site, and Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme confidence in its malicious nature.

No additional public intelligence, such as malware hashes or victim reports, is available at this time. Given the observed indicators—recent registration, Cloudflare‑hosted IP, active SSL, WordPress deployment, low trust score, and multiple blocklist entries—defenders should treat cryptogram.ae as a high‑risk crypto scam source. Recommended actions include adding the domain to DNS and URL filtering policies, monitoring for outbound connections to the associated IP address, and flagging any email traffic that references the Mailgun endpoints observed on the site. Continuous re‑evaluation is advised, as the payload and victim‑facing content have not been publicly disclosed.