cryptoier[.]net

cryptoier.net is a newly registered domain observed in a generic phishing campaign. The domain was created on 24 March 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. Authority records list ns1.metaquotes.business and ns2.metaquotes.business as the authoritative nameservers. DNS resolution points to the IPv4 address 91.92.241.159, which is the sole host reported for the domain at the time of analysis.

The domain appears on a single security blocklist and is actively blocked by the PhishDestroy filtering service. VirusTotal has processed the domain via 91 scanning engines; none of the engines flagged the domain as malicious, although the absence of detections does not constitute a safety guarantee. No additional intelligence such as Safe Browsing alerts, OTX references, SSL certificate details, HTTP response codes, trust‑score metrics, or page‑title information is currently available. The limited observable footprint suggests a low‑profile infrastructure that may rely on rapid domain turnover and minimal exposure to reputation‑building services.

Uncertainty remains regarding the payload delivered by the site, the specific phishing kit employed, and any potential command‑and‑control infrastructure. Defenders should incorporate the domain into existing phishing‑prevention controls, enforce DNS‑based blocklists that include the identified blocklist entry, and monitor the associated IP address for anomalous traffic. Continuous re‑evaluation of the domain on VirusTotal and other reputation services is advised, as additional detections may appear if the campaign becomes more active. Organizations handling credential‑sensitive workflows should treat any communications referencing cryptoier.net as suspicious until further verification.