crypt[.]circlespans[.]com

Analysis of crypt.circlespans.com indicates that the domain was actively used for phishing before being taken offline. The site presented the page title “Circle”, which is the only visible content captured. DNS resolution points to the IPv4 address 15.168.201.92, an Amazon Web Services host located in Japan (AS16509). The domain is listed on a single public blocklist and is specifically blocked by the PhishDestroy service, confirming that security operators have observed malicious activity.

VirusTotal records show that ten of ninety‑five scanning engines flagged the domain as malicious, providing independent corroboration of its abusive nature. Registration data reveals that the domain was created on 2 October 2025 through Gname.com Pte. Ltd., a registrar known to host both legitimate and illicit domains. The domain lacks an SSL/TLS certificate, which is consistent with many rapid‑deployment phishing sites that forego HTTPS to reduce setup time. Name server records are hosted on Cloudflare (jim.ns.cloudflare.com, princess.ns.cloudflare.com), a common choice for threat actors seeking DDoS mitigation and fast DNS propagation.

The current status is offline, preventing further live interaction, but the historical evidence is sufficient to classify the domain as a confirmed phishing site. Uncertainty remains regarding the exact content that was served, the targeted brand or credential type, and whether additional infrastructure (command‑and‑control servers, credential‑harvesting pages) existed beyond the observed host. Defenders should continue to block the domain at perimeter and DNS layers, update local blocklists with the observed IP address and nameserver entries, and monitor for any re‑registration of the same second‑level domain or similar patterns. Incident response teams should also consider correlating logs for connections to 15.168.201.92 during the active period and verify that no residual phishing pages remain on the hosting provider.