calderaescrow[.]com

The domain calderaescrow.com has been confirmed as a crypto escrow scam, designed to deceive users into transferring digital assets under the guise of a legitimate escrow service. Analysis indicates this infrastructure is not associated with any authentic financial entity but instead operates as a fraudulent platform to facilitate unauthorized asset transfers. The domain currently remains offline, though its prior activity aligns with known patterns of crypto-related fraud targeting unsuspecting victims seeking secure transaction intermediaries. Infrastructure analysis reveals the domain was registered on June 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in association with high-risk domains. It resolves to the IP address 165.99.164.20, which has been linked to other suspicious activities in recent threat intelligence reports. Detection metrics indicate limited but concerning visibility, with 1 of 95 security vendors on VirusTotal flagging the domain as malicious. No additional blocklist entries or trust scores were recorded at the time of analysis, suggesting either early-stage deployment or evasion of broader detection mechanisms. Given the domain's current offline status, immediate risk to end users is reduced; however, historical activity and infrastructure characteristics warrant continued monitoring. Organizations and individuals are advised to block the domain and associated IP at the network level, update endpoint protection rules to include this indicator of compromise, and educate users on recognizing crypto escrow scams. If financial transactions were conducted via this platform, affected parties should report the incident to relevant authorities and initiate asset recovery protocols where possible. Proactive threat hunting for related domains registered through the same registrar or resolving to the identified IP is recommended to identify potential secondary threats.