crypto-online-us[.]online

The domain crypto-online-us.online was registered on March 06, 2026 through Go Daddy, LLC. It resolves to the Amazon-owned address 76.223.105.230, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The authoritative name servers are ns39.domaincontrol.com and ns40.domaincontrol.com, both operated by GoDaddy. An SSL certificate issued by Go Daddy Secure Certificate Authority – G2 is present, confirming that the site uses a valid TLS handshake.

The web server returns HTTP 200 and the page title is identical to the domain name, a pattern frequently observed in generic phishing campaigns that aim to mimic legitimate cryptocurrency services. Gridinsoft assigns a trust score of 0 / 100, indicating a complete lack of credibility. VirusTotal analysis shows that 2 of 95 security vendors flag the domain, and the host appears on three public blocklists. Independent blocklist services such as PhishDestroy, MetaMask, and SEAL have already listed the site as malicious.

Active monitoring shows the domain remains reachable as of July 12 2026, confirming its operational status. The combination of a newly created domain, low trust score, minimal vendor detection, and inclusion on multiple phishing‑focused blocklists aligns with the high‑risk classification for generic phishing. However, the exact phishing payload, targeted cryptocurrency platform, and victim demographics have not been publicly disclosed, leaving the full scope of the campaign uncertain.

Defenders should add crypto-online-us.online to network and endpoint blocklists, enforce DNS filtering, and monitor TLS connections for the Go Daddy Secure Certificate Authority – G2 issuance. Given the association with Amazon infrastructure, traffic to the IP address 76.223.105.230 should be inspected for anomalous request patterns. Continuous re‑evaluation is advised, as additional security vendors may raise their detection scores as more samples become available.