# create-now.fun — SUSPICIOUS

> Beware: create-now.fun is a credential-harvesting site mimicking a login page. VirusTotal shows 0/95 detections while stealing crypto wallet access.

## Summary
PhishDestroy identifies create-now.fun as an active credential-harvesting domain designed to impersonate legitimate login portals, specifically targeting cryptocurrency users. This domain, registered on March 29, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, is hosted on IP address 188.114.96.3 and secured with a Let's Encrypt SSL certificate—a tactic frequently exploited by threat actors to appear legitimate. Notably, VirusTotal currently shows 0/95 detections, meaning no antivirus engines have flagged the domain despite its malicious intent. The domain's recent creation date and clean reputation score suggest it is part of a rapidly evolving campaign to deceive users into surrendering sensitive login credentials.  This domain exemplifies a classic phishing strategy: creating urgency around account access to trick victims into entering their credentials on a spoofed page. Threat intelligence indicates that such domains often lead to direct financial loss, as stolen credentials may grant attackers access to cryptocurrency wallets or exchange accounts. The combination of a low VirusTotal detection rate, recent domain registration, and the use of a free SSL certificate underscores the sophistication of this attack vector, which is designed to bypass initial scrutiny. Users interacting with this domain are at risk of credential theft, account takeover, and potential financial theft, particularly in the cryptocurrency sector where irreversible transactions are common.  If you have visited create-now.fun or entered any credentials, immediately revoke access to all linked accounts, enable two-factor authentication where possible, and scan your devices for malware. Do not reuse passwords across platforms, as compromised credentials can be exploited across multiple services. Report the domain to PhishDestroy to help block future attacks. For ongoing protection, verify suspicious links using PhishDestroy's real-time threat database before interacting with any web page. Stay vigilant—cybercriminals continuously adapt their tactics to exploit trust and urgency.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-29 20:20:29
- Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/75b47865-0aa2-475e-83b4-569e6a8d6418
- PhishDestroy: https://phishdestroy.io/domain/create-now.fun/
- LLM endpoint: https://phishdestroy.io/domain/create-now.fun/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/create-now.fun/
Last updated: 2026-03-30