cricfy[.]co

The domain cricfy.co was identified as a credential theft infrastructure targeting users seeking live cricket streaming applications. Analysis indicates the site impersonated a legitimate Android app, "CricFy TV v6.3," to harvest user credentials or distribute malicious payloads. As of the latest verification, the domain has been taken offline, though prior activity classified it as high-risk due to its deceptive practices. Infrastructure analysis reveals the domain was registered on June 08, 2026, through DYNADOT LLC and resolved to the IP address 172.67.220.159. It was flagged by 15 of 95 security vendors on VirusTotal, indicating broad detection across threat intelligence platforms. The domain appeared on three security blocklists and was referenced in four AlienVault OTX threat intelligence pulses. Additional indicators include its SSL certificate issued by Let's Encrypt and prior blocking by multiple security providers. While cricfy.co is currently offline, the infrastructure's prior use for credential theft warrants continued vigilance. Organizations and users are advised to monitor for residual threats, such as redirected domains or similar impersonation attempts. Network administrators should review logs for connections to 172.67.220.159 and the domain itself, while end-users should verify the authenticity of any cricket streaming applications before installation. Proactive measures, including domain reputation checks and endpoint protection updates, are recommended to mitigate risks from related threats.