# csrrun.com — SUSPICIOUS

> csrrun.com claims to offer crypto investment returns but is a fake portal stealing credentials. PhishDestroy blocks this active domain registered April 27, 2025.

## Summary
csrrun.com is an active cryptocurrency investment scam site posing as a legitimate trading platform. This domain is currently under investigation for generic phishing activity designed to harvest user credentials and steal cryptocurrency deposits. The site is being actively blocked by PhishDestroy, indicating confirmed malicious intent. Users should avoid any interaction with this domain and report it to their security teams immediately.


This domain was flagged by PhishDestroy after being detected on one security blocklist. VirusTotal currently shows 0/95 detections, meaning no antivirus engines have flagged it yet despite its malicious nature. The domain resolves to IP 188.114.96.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 27, 2025. The SSL certificate is issued by Google Trust Services, which could give users a false sense of security despite the domain's malicious purpose.


To protect against this cryptocurrency phishing scam, users should immediately block access to csrrun.com through their network filters. If anyone has already entered credentials or deposited funds, they should immediately change all related passwords and contact their cryptocurrency exchange or wallet provider to report the fraud. This domain should be reported to PhishDestroy and local cybercrime units to help prevent further victimization. Always verify investment platforms through official channels and never trust unsolicited investment opportunities promising high returns.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-04-27 13:42:05
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/f55164ef-e3ba-41d2-be23-0e560ea8cb32
- PhishDestroy: https://phishdestroy.io/domain/csrrun.com/
- LLM endpoint: https://phishdestroy.io/domain/csrrun.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/csrrun.com/
Last updated: 2026-03-27