# PhishDestroy domain threat record: crytpoaa.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/crytpoaa.com/
Machine-readable companion: https://phishdestroy.io/domain/crytpoaa.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:16:25 UTC
- Last availability or vendor check: 2026-10-26 16:24:39 UTC
- Stored record updated: 2026-10-26 20:15:28 UTC
- VirusTotal detections in the stored snapshot: 10/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: mastercard

## Stored infrastructure

- Observed IP address: 207.57.188.72
- Registrar in stored WHOIS data: Key-Systems GmbH
- Registrar country in stored WHOIS data: SG
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-24 08:57:25 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17905-e4e9-70d6-9229-49c3f8429edf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/crytpoaa.com
- Certificate Transparency search: https://crt.sh/?q=%25.crytpoaa.com
- Web Archive lookup: https://web.archive.org/web/*/https://crytpoaa.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot of crytpoaa.com on 2026-10-26 showed a Crypto-AA exchange page headlined Find Your Next Moonshot, a stated 24 hour trading volume of $289,789,518.011, an email or mobile phone field with a Register button, and a market table of BTC/USDT and ETH/USDT pairs with Trade buttons. PhishDestroy classified it as an impersonation phishing page in its automated assessment. PhishDestroy first saw the domain on 2026-10-26, two days after its 2026-10-24 registration.

How the scam works
The registration field and Trade buttons form a fake exchange sign-up funnel that invites visitors to submit an email address or mobile number to a fabricated trading service, a category risk for credential harvesting. The moonshot headline and huge volume figure supply the lure. As observed on 2026-10-26, the flow led from the front page into an internal trading list path.

Evidence
The screenshot shows Crypto-AA branding, a registration form and a market table as observed on 2026-10-26. urlscan scored its engine verdict malicious at 96 while its overall verdict stayed non-malicious, and recorded a 307 upgrade to HTTPS then a 302 into an internal trading path. VirusTotal flagged the domain as malicious, with phishing labels including Kaspersky, Fortinet and BitDefender. Spamhaus listed it as spam, MetaMask and SEAL blocklists plus PhishDestroy's internal list flagged it, OTX recorded 3 pulses, Google Safe Browsing was not flagged and 0 of 12 resolvers blocked it; site inspection recorded jQuery, Bootstrap, Popper and layer on a ThinkPHP stack, font and script-CDN trackers, and 2 script SHA256 hashes (first a586f420effb) for pivoting.

Infrastructure
crytpoaa.com was registered through Key-Systems GmbH on 2026-10-24 with hosting recorded on the Zillion Network network in the US. Weaknesses first: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; HSTS present at max-age 31536000; TLS 1.3 with TLS-AES-256-GCM-SHA384, forward secrecy and ALPN h2; SPF lookups recorded as zero; CAA record present; DNSSEC unsigned.

What to do
If you submitted an email, mobile number or password through crytpoaa.com, change that password on the genuine service and enable two-factor authentication, and treat any contact from the domain as hostile. Do not complete purchases or trades prompted by the page. Defenders should block crytpoaa.com in proxy, DNS and mail controls, and pivot on the recorded script hashes.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17905-e4e9-70d6-9229-49c3f8429edf/
Cloudflare Radar report: https://radar.cloudflare.com/scan/ecf30a20-dbc8-4f17-b742-66e8a41ca38a
URLQuery report: https://urlquery.net/report/7ccd1ea2-4afe-496c-a234-bd4c83d564a7
Stored capture screenshot: https://i.ibb.co/DDZKvrMs/05c4c687c2e8.png
Cloudflare Radar screenshot (2026-10-26T16:19:16Z): https://screenshots.phishdestroy.io/cf/ecf30a20-dbc8-4f17-b742-66e8a41ca38a.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/7ccd1ea2-4afe-496c-a234-bd4c83d564a7.png
URLScan screenshot (2026-10-25T01:13:29Z): https://screenshots.phishdestroy.io/us/01a1709e-0a7e-7211-a24b-241d54a6b20f.png
URLScan capture report: https://urlscan.io/result/01a1709e-0a7e-7211-a24b-241d54a6b20f/
URLScan screenshot (2026-10-25T01:35:31Z): https://screenshots.phishdestroy.io/us/01a170b2-a105-771b-9a79-3caa4b731202.png
URLScan capture report: https://urlscan.io/result/01a170b2-a105-771b-9a79-3caa4b731202/
URLScan screenshot (2026-10-25T20:17:29Z): https://screenshots.phishdestroy.io/us/01a174b5-dca5-75c0-898a-cb12ebfc8249.png
URLScan capture report: https://urlscan.io/result/01a174b5-dca5-75c0-898a-cb12ebfc8249/
URLScan screenshot (2026-10-25T20:41:40Z): https://screenshots.phishdestroy.io/us/01a174cc-0e57-717e-a13e-f79411868ad5.png
URLScan capture report: https://urlscan.io/result/01a174cc-0e57-717e-a13e-f79411868ad5/
VirusTotal report: https://www.virustotal.com/gui/domain/crytpoaa.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=crytpoaa.com
Archived copy: https://web.archive.org/web/20261026162025/https://crytpoaa.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:15:28 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/DDZKvrMs/05c4c687c2e8.png
  Captured: 2026-10-26 16:24:39 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17905-e4e9-70d6-9229-49c3f8429edf.png
  Captured: 2026-10-26 16:24:39 UTC
  Source report: https://urlscan.io/result/01a17905-e4e9-70d6-9229-49c3f8429edf/
- URLScan capture 2: https://urlscan.io/screenshots/01a176c8-708b-746e-b972-6c540aee0aa6.png
  Captured: 2026-10-26 16:16:25 UTC
  Source report: https://urlscan.io/result/01a17905-e4e9-70d6-9229-49c3f8429edf/
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1709e-0a7e-7211-a24b-241d54a6b20f.png
  Captured: 2026-10-25 01:13:29 UTC
  Source report: https://urlscan.io/result/01a1709e-0a7e-7211-a24b-241d54a6b20f/
  SHA-256: 1e000627d87e5a4da60414b4e37719f2d6fc978b0cb7aba9ce8be33e5d7141f7
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a170b2-a105-771b-9a79-3caa4b731202.png
  Captured: 2026-10-25 01:35:31 UTC
  Source report: https://urlscan.io/result/01a170b2-a105-771b-9a79-3caa4b731202/
  SHA-256: c9a27c06e4d7540bf9835af8bc6e49b9add23df520b8c6294a64bc5c307167c0
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a174b5-dca5-75c0-898a-cb12ebfc8249.png
  Captured: 2026-10-25 20:17:29 UTC
  Source report: https://urlscan.io/result/01a174b5-dca5-75c0-898a-cb12ebfc8249/
  SHA-256: 8cc81ed49df72c6e017933b56b128acbb4716f03af4fa92941001e2b5dc3949d
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a174cc-0e57-717e-a13e-f79411868ad5.png
  Captured: 2026-10-25 20:41:40 UTC
  Source report: https://urlscan.io/result/01a174cc-0e57-717e-a13e-f79411868ad5/
  SHA-256: 88a63c0f80cc36586043ec9f573e64b253a907f6cd7c46c77cbffbb35d204b47
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ecf30a20-dbc8-4f17-b742-66e8a41ca38a.png
  Captured: 2026-10-26 16:19:16 UTC
  Source report: https://radar.cloudflare.com/scan/ecf30a20-dbc8-4f17-b742-66e8a41ca38a
  SHA-256: 273e424aace5955655ba054a9c76a8e8c2d42611868a928e4c3a9d909c72f224
- URLQuery: https://screenshots.phishdestroy.io/uq/7ccd1ea2-4afe-496c-a234-bd4c83d564a7.png
  Source report: https://urlquery.net/report/7ccd1ea2-4afe-496c-a234-bd4c83d564a7
  SHA-256: bbc1771376d79a21372facf7c4c77a717f38922d31f2b262ea2325af0940283d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:10Z",
        "uuid": "01a17905-e4e9-70d6-9229-49c3f8429edf",
        "scanned_at": "2026-10-26T16:23:25Z",
        "final_url": "https://crytpoaa.com/Trade/tradelist",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://crytpoaa.com/",
                "from": "http://crytpoaa.com/",
                "status": 307
            },
            {
                "to": "https://crytpoaa.com/Trade/tradelist",
                "from": "https://crytpoaa.com/",
                "status": 302
            }
        ],
        "ip": "207.57.188.72",
        "domains": [
            "cdn.jsdelivr.net",
            "cdn.staticfile.org"
        ],
        "ips": [
            "202.181.25.22",
            "104.17.207.5",
            "207.57.188.72"
        ],
        "asns": [
            "55933",
            "13335",
            "54801"
        ],
        "countries": [
            "HK",
            "US"
        ],
        "doc_hash": "7f618a75256a60ba1d7878d571a13aa69e7413047411b9d51e58e38b06bcb90c",
        "script_hashes": [
            "a586f420effbe849c9026d8ab400f5f900826b5a1a01e091467b57224e897eb7",
            "01c1dac4350f12ee1499491a4f59008e04f17e414c2e15a16690f3b3fe0b1f55"
        ],
        "globals": [
            "handleClick",
            "$",
            "jQuery",
            "Popper",
            "bootstrap",
            "layer",
            "obtain_btc",
            "obtain_eth",
            "obtain_eos",
            "obtain_doge",
            "obtain_bch",
            "obtain_ltc",
            "obtain_iota",
            "obtain_fil",
            "obtain_flow",
            "obtain_jst",
            "obtain_itc",
            "obtain_ht",
            "obtain_hm",
            "setCookie",
            "getCookie",
            "getonemarket",
            "AutoScroll",
            "navigationOptions",
            "links"
        ],
        "cookies": [
            "_is_index",
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "crypto-aa.vip",
                "crypto-aaaa.com",
                "crytpoaa.com",
                "www.crypto-aa.vip",
                "www.crypto-aaaa.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "crypto-aaaa.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-22T10:00:46Z",
            "valid_from": "2026-10-24T10:00:47Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 62,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "ThinkPHP",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:23:59Z",
        "uuid": "ecf30a20-dbc8-4f17-b742-66e8a41ca38a",
        "scanned_at": "2026-10-26T16:19:16Z",
        "final_url": "https://crytpoaa.com/",
        "status": 200,
        "history": [
            {
                "url": "https://crytpoaa.com/",
                "status": 200
            }
        ],
        "dom_hash": "3e7f62dc6780adb1d5b1c621d93ad98f554b5e1a02cd6ba3e48bd04a4a6cf3b2",
        "doc_hash": "0f689541a62d71c017c04fc8a102567c01a8d2e4f53ef024865c588de90d94db",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "New Domains",
            "Security Risks",
            "Newly Seen Domains",
            "Scam",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "crytpoaa.com",
                "type": "A",
                "value": "207.57.188.72"
            }
        ],
        "dnssec_valid": false,
        "ip": "207.57.188.72",
        "whois": {
            "registrar": "Key-Systems GmbH",
            "created": "2026-10-24T10:57:25Z",
            "updated": "2026-10-24T10:57:25Z",
            "expires": "2027-10-24T10:57:25Z",
            "nameservers": [
                "ns1.domainnamedns.com",
                "ns2.domainnamedns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:51:00Z",
        "analysis_at": "2026-10-26T01:15:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 10,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Emsisoft": "malware",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "malicious"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Malicious, Spam (alphaMountain.ai)"
        },
        "registrar": "Key-Systems GmbH",
        "created": "2026-10-24T10:57:25Z",
        "expires": "2027-10-24T10:57:25Z",
        "updated": "2026-10-24T11:02:29Z",
        "first_seen": "2026-10-24T11:05:50Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns3.domainnamedns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "207.57.188.72"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "support.namens.net",
                "value": "ns1.domainnamedns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns4.domainnamedns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.domainnamedns.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.domainnamedns.com"
            }
        ],
        "dns_at": "2026-10-26T01:20:59Z",
        "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763",
        "cert": {
            "san": [
                "crypto-aa.vip",
                "crypto-aaaa.com",
                "crytpoaa.com",
                "www.crypto-aa.vip",
                "www.crypto-aaaa.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "698fcb2925d945b7c0f64c08d4aa03afbf3",
            "sha256": "709193d07d69bc97c4a0b44216c3c71c26df7b2ea507b07e6a000dd74c319a83",
            "subject": "crypto-aaaa.com",
            "valid_to": "2027-01-22T10:00:46Z",
            "valid_from": "2026-10-24T10:00:47Z"
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "registrar_iana_id": "269",
            "registrar_url": "http://www.key-systems.net",
            "created": "2026-10-24T10:57:25Z",
            "updated": "2026-10-24T11:02:29Z",
            "expires": "2027-10-24T10:57:25Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.domainnamedns.com",
                "ns2.domainnamedns.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-24T10:57:25Z",
                "last changed": "2026-10-24T11:02:29Z",
                "registration": "2026-10-24T10:57:25Z",
                "registrar expiration": "2027-10-24T10:57:25Z",
                "last update of RDAP database": "2026-10-24T11:05:39Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:24:21Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "crytpoaa.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:20:25Z",
            "first": "2026-10-26T16:20:25Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 22167
        },
        "social_tags": {
            "title": "Crypto-AA"
        },
        "trackers": {
            "requests": 55,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 3,
                "tls": 165,
                "wait": 323,
                "connect": 162,
                "download": 320
            },
            "response_ms": 973
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 106511,
            "co2_grams": 0.0039,
            "cleaner_than": 21
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "67.220.72.51",
                    "host": "ns4.domainnamedns.com"
                },
                {
                    "ip": "216.106.185.75",
                    "host": "ns1.domainnamedns.com"
                },
                {
                    "ip": "54.151.142.119",
                    "host": "ns3.domainnamedns.com"
                },
                {
                    "ip": "38.114.114.183",
                    "host": "ns2.domainnamedns.com"
                }
            ],
            "zone": "crytpoaa.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "PHPSESSID",
                    "session": true
                }
            ]
        },
        "location": {
            "ip": "207.57.188.72",
            "asn": "54801",
            "org": "NTT America",
            "city": "San Jose",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "crypto-aaaa.com"
        },
        "dns": {
            "A": [
                "207.57.188.72"
            ],
            "NS": [
                "ns2.domainnamedns.com",
                "ns1.domainnamedns.com",
                "ns4.domainnamedns.com",
                "ns3.domainnamedns.com"
            ],
            "SOA": "{\"nsname\": \"ns1.domainnamedns.com\", \"hostmaster\": \"support.namens.net\", \"serial\": 1792839483, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 180}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "207.57.188.72",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://crytpoaa.com"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.simplex.com/account/buy",
                "https://banxa.com/"
            ],
            "external_count": 2,
            "internal_count": 29
        },
        "whois": {
            "registrar": "Key-Systems GmbH",
            "created": "2026-10-24T10:57:25Z",
            "updated": "2026-10-24T11:02:29Z",
            "expires": "2027-10-24T10:57:25Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.domainnamedns.com",
                "ns2.domainnamedns.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=utf-8",
                "x-powered-by": "ThinkPHP",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```