cryytaonlogonnii[.]webflow[.]io

On 23 July 2026 the domain cryytaonlogonnii.webflow.io was observed hosting a page titled “Çrypto.com* Login - Sign_In Today Now”. The page title explicitly references Crypto.com, matching the declared brand target. Registration data shows the domain was created on 7 March 2026 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, indicating the attackers leveraged a reputable registrar to increase perceived legitimacy. The site was built on Webflow and served via Cloudflare, with HTTP/3 enabled. DNS resolution points to IP address 172.64.151.8, which belongs to Cloudflare’s AS13335 network located in the United States. An SSL certificate issued by Google Trust Services (common name WE1) is present, confirming that TLS termination is handled by Cloudflare’s edge.

HTTP probing returned a 404 status, suggesting the malicious landing page has been removed or is otherwise inaccessible at the time of analysis. Threat‑intelligence aggregators have flagged the domain. It appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans recorded 13 detections out of 94 AV engines, indicating a moderate level of consensus among scanners that the site is malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The overall classification is a “Crypto Scam” that impersonates Crypto.com, consistent with the page title and brand target.

The current status is marked “offline”, and no live content could be retrieved, limiting the ability to examine the exact phishing mechanics. However, the combination of a brand‑specific page title, reputable registrar, Cloudflare hosting, and multiple vendor detections provides sufficient evidence to treat the domain as malicious. Defenders should block the domain at perimeter defenses, update URL filtering and threat‑intel feeds, and monitor for any related infrastructure that resolves to the same Cloudflare IP range.