crackstreams[.]fit

crackstreams.fit is an active domain first observed on September 5 2025. The site presents the page title “CrackStreams - Watch Free Sports NFL, NBA, UFC, NHL & More”, but intelligence flags it as a brand‑impersonation campaign targeting UPS. The domain appears on two external blocklists and is listed by PhishDestroy and ScamSniffer as an impersonation site.

The domain resolves to IP 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is physically located in the United States. Registration was performed through NameCheap, Inc., and the authoritative nameservers are lovisa.ns.cloudflare.com and sterling.ns.cloudflare.com. TLS is provided by Google Trust Services under the WE1 certificate, and HTTP requests receive a 301 redirect response.

Reputation services assign a Gridinsoft trust score of 0/100 and a Scamadviser score of 31/100, indicating a highly suspicious profile. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain, and the site is detected by security‑blocklists. Detected technologies include DTScout, Cloudflare Browser Insights, Cloudflare, 33Across and HTTP/3, which are typical of fast‑content delivery but do not mitigate the malicious intent. The explicit impersonation of UPS is corroborated by the “Impersonates: ups” tag in the intelligence feed.

Defenders should add the domain and its resolving IP to outbound and inbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and block any HTTP/HTTPS traffic to the URL. Incident response teams should treat any credential or payment information submitted to this site as compromised, and users should be warned that the site is a high‑risk impersonation vector. Continuous monitoring of the domain’s reputation and re‑evaluation of the two vendor flags on VirusTotal are advised.