878391-crypto[.]com

Analysis of 878391-crypto.com shows that the domain was registered on 21 February 2026 through NETIM SAS. The site was hosted on IP 185.241.208.160, which belongs to AS210558 operated by 1337 Services GmbH in Poland. DNS resolution points to nameservers ns1.rdp.sh and ns2.rdp.rs. No TLS certificate is presented, indicating that the service was delivered over plain HTTP. The server stack identified Tailwind CSS, the Caddy web server, and HTTP/3 support.

A request to the root URL returned the page title “Domain Suspended,” and the domain is currently offline. VirusTotal records indicate that 8 of 93 scanned security vendors flagged the host as malicious, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL. The infrastructure is labeled as a crypto‑scam and explicitly impersonates the Crypto.com brand. The risk rating is elevated.

Defenders should add 185.241.208.160 and the domain name to block lists, monitor for any future re‑hosting of the same certificate‑less infrastructure, and enforce outbound filtering for connections to the identified nameservers. Because the site is offline, any active credential‑harvesting activity is likely halted, but the registration pattern suggests a potential reuse of the same hosting assets for new phishing campaigns. Continuous watch‑listing of the registrar NETIM SAS and the AS210558 prefix is recommended, as well as periodic re‑scans on VirusTotal and similar services to capture any changes in detection status. Organizations using Crypto.com should educate users about unsolicited communications and verify URLs before entering credentials, given the confirmed brand impersonation.