cyberlaunch[.]fun

PhishDestroy identifies www.cyberlaunch.fun as an active credential theft scam impersonating CyberLaunch, a cryptocurrency launch platform. The domain leverages a spoofed login portal to harvest user credentials, likely targeting victims seeking early access to new crypto projects. No cryptocurrency drainer kit or advanced obfuscation techniques were detected in initial analysis, suggesting a basic but effective credential harvesting operation. The threat actor’s infrastructure mirrors CyberLaunch’s branding to maximize deception, relying on social engineering rather than technical sophistication.

This domain was flagged with the following technical indicators: VirusTotal detection rate of 2/95, registered through GoDaddy.com, LLC, resolving to IP 64.29.17.65. The domain was created on December 05, 2025, and secured with a Let’s Encrypt SSL certificate. Google Safe Browsing (GSB) has not yet flagged the domain, and no third-party blocklists have been updated to include it. The lack of detections indicates a newly deployed or low-sophistication threat, but the domain’s recent creation and absence from blocklists make it a high-risk vector for users.

The campaign is currently active, with no takedown or mitigation measures observed. Immediate actions include blocking the domain at the network level, updating browser blacklists, and notifying CyberLaunch’s security team for brand protection. Remaining risk is high due to the domain’s low detection profile and recent registration. Users should avoid interacting with any links or attachments from this domain and verify URLs through official CyberLaunch channels before submitting credentials. Organizations are advised to deploy DNS filtering and endpoint protection to block access to www.cyberlaunch.fun and similar domains.