app[.]crustwin[.]com

The domain app.crustwin.com was registered on April 29, 2026 through Fewmoretaps OU doing business as Trustname.com and is currently resolving to the IPv4 address 64.7.198.11. Its authoritative name servers are chad.ns.cloudflare.com and kenia.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s network. The domain is listed as active and has been flagged by the PhishDestroy blocklist, confirming that it is being actively monitored for malicious activity. VirusTotal has recorded 11 detections out of 91 scanned security vendors, demonstrating that a notable portion of the security community recognises the site as malicious. Additionally, the domain appears on one external security blocklist, further corroborating its reputation as a threat vector.

Publicly available intelligence does not contain details on the site’s SSL certificate, HTTP response codes, Safe Browsing status, or any Open Threat Exchange (OTX) identifiers, leaving those aspects of the infrastructure unverified at this time. No page title or brand targeting information has been disclosed, so the precise visual or thematic content of the landing page remains unknown. The lack of these data points limits the ability to attribute a specific phishing lure, but the classification as generic phishing is supported by the detection counts and blocklist presence.

Defenders should add app.crustwin.com to domain‑based block lists across perimeter firewalls, DNS filtering services, and endpoint protection suites. Monitoring of DNS queries for the two Cloudflare name servers can provide early warning of any resolution attempts. Given the 11 VirusTotal detections, security teams should treat any traffic to this address as malicious and quarantine or drop the connections. Continuous re‑evaluation is advised, as additional intelligence such as SSL fingerprint, HTTP status, or page content may emerge, allowing more granular mitigation.