afs-crypto[.]com

This domain is classified as high-risk due to active brand impersonation targeting Crypto.com, a major cryptocurrency exchange platform. The threat involves fraudulent wallet recovery or account verification pages designed to harvest credentials, private keys, or two-factor authentication codes from unsuspecting users. Infrastructure analysis confirms the domain is engineered to deceive users into disclosing sensitive financial information under the guise of legitimate Crypto.com services. Analysis indicates the domain afs-crypto.com was registered on April 8, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and is currently flagged by 11 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists and is explicitly blocked by MetaMask, PhishDestroy, SEAL, and InversionDNS. Google Safe Browsing categorizes the domain under SOCIAL_ENGINEERING, reinforcing its role in deceptive practices. The registration date suggests recent deployment, while the IP resolution points to infrastructure commonly associated with transient phishing campaigns. Mitigation against this threat requires immediate action from both end-users and security teams. Users should avoid interacting with afs-crypto.com and verify the authenticity of any communication claiming to originate from Crypto.com by accessing the platform directly through official channels. Security teams are advised to implement DNS-based blocking for the domain and its associated IP address, 188.114.97.3, within corporate and institutional networks. Monitoring for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED may help preemptively identify related threats. Organizations should also enforce multi-factor authentication and educate users on recognizing social engineering tactics, particularly those exploiting cryptocurrency brands.