cryptoroyal[.]win

The domain cryptoroyal.win, registered on February 21, 2026 through EuroDNS SA, remains active as of the report date, July 24, 2026. DNS resolution points to the IPv4 address 34.175.78.255, which is hosted within the AS396982 Google LLC network and geolocated to Spain. All four authoritative name servers—ns1.eurodns.com, ns2.eurodns.com, ns3.eurodns.com, and ns4.eurodns.com—are operated by the registrar, indicating a single‑point control of the domain's DNS infrastructure. The site returns an HTTP 200 response while the page title displays “403 - Forbidden,” suggesting a possible mismatch between the HTTP status code and the content served, a pattern often observed in deceptive hosting setups.

No SSL/TLS certificate is presented, leaving the connection unencrypted and exposing users to network‑level interception. Reputation metrics are extremely low, with Scamadviser assigning a trust score of 1 out of 100 and Gridinsoft rating the domain at 0 out of 100, reinforcing the malicious nature of the site. The domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—demonstrating consensus among security providers that the domain is employed for phishing. VirusTotal analysis shows that two of ninety‑three scanned security vendors flagged the domain, providing additional confirmation of its malicious intent.

While the exact phishing payload or targeted brand is not disclosed in the available intelligence, the combination of a recent registration, lack of encryption, low trust scores, and multiple blocklist listings classifies cryptoroyal.win as a high‑risk phishing infrastructure. Defenders should enforce network‑level blocking of the domain and its associated IP address, incorporate the observed blocklist entries into existing filtering solutions, and monitor for any changes in DNS or hosting that could indicate further campaign evolution.