crypto---aauth--issued[.]webflow[.]io

This domain, crypto---aauth--issued.webflow.io, was identified as a credential theft operation targeting users of Crypto.com, a major cryptocurrency exchange platform. The site was designed to mimic the official Crypto.com login interface, tricking visitors into entering their account credentials. Once submitted, these credentials would likely be harvested by threat actors for unauthorized account access, financial theft, or further exploitation in follow-up attacks. The page title, 'Crypto.com® Login issues® | Helping Center Navigating,' was crafted to appear as a legitimate support portal, increasing the likelihood of user engagement. Analysis indicates this domain was flagged by 19 out of 95 security vendors on VirusTotal, a clear indicator of malicious activity. It was registered through Webflow, a platform commonly abused for hosting phishing infrastructure due to its ease of use and low cost. The domain resolved to the IP address 172.64.151.8, associated with Cloudflare, Inc. in Canada, a common tactic to obscure the true origin of the attack. Additionally, the domain appeared on at least one security blocklist prior to being taken offline, further confirming its malicious nature. If you visited crypto---aauth--issued.webflow.io or entered any credentials on the site, immediate action is required. First, assume your account has been compromised and change your Crypto.com password using a secure device. Enable multi-factor authentication (MFA) if not already active, and review your account for unauthorized transactions or changes. Monitor linked email accounts and financial services for suspicious activity, as stolen credentials may be used in secondary attacks. Report the incident to Crypto.com’s official security team and consider notifying local cybersecurity authorities if financial loss occurred. Avoid reusing passwords across platforms to limit the impact of credential theft.