cryonchain[.]top

This domain is flagged as a high-risk credential-harvesting phishing site specifically targeting cryptocurrency wallet users. Analysis indicates the infrastructure is designed to impersonate legitimate wallet interfaces, tricking users into submitting private keys or recovery phrases. The domain exhibits multiple indicators of malicious intent, warranting immediate caution from security teams and end users. Infrastructure analysis reveals the domain cryonchain.top was registered on November 23, 2025, through Gname.com Pte. Ltd. It currently resolves to the IP address 118.107.13.102, hosted by AS152194 CTG Server Limited in Japan. The domain appears on three security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal. It employs a Let's Encrypt SSL certificate (R13) to create a false sense of legitimacy. The domain remains active and continues to resolve, suggesting ongoing malicious operations. Mitigation for this specific threat type involves immediate blocking of the domain and its resolving IP at network and endpoint levels. Security teams should monitor for connections to 118.107.13.102 and inspect SSL certificates issued to cryonchain.top. Users should be educated to verify wallet interfaces through official channels only, avoiding any domain resembling legitimate services. Cryptocurrency operators should implement strict domain validation checks and warn users about credential harvesting risks associated with newly registered domains impersonating wallet services.