neocoinex[.]disturbedvipaccess[.]com

Analysis of neocoinex.disturbedvipaccess.com indicates that the domain was registered on February 21, 2026 and is currently taken offline. The site presented a page titled “Hyip Investment Platform” and was designed to impersonate crypto.com, satisfying the classification of brand impersonation. VirusTotal recorded two detections out of ninety‑three scanners, confirming that at least a small subset of security products identified malicious behavior. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, while Scamadviser rates it 1 / 100, reflecting the high probability of fraud. The SSL certificate is labeled “R13”, which is commonly associated with fraudulent certificates used in phishing campaigns. The overall risk level has been marked elevated. No further infrastructure details such as IP address, ASN, or hosting provider are available in the current intelligence set.

Defenders should continue to block the domain at perimeter and DNS filtering layers, enforce monitoring for any future re‑registration of the same second‑level name, and incorporate the observed indicators into threat‑intel feeds. Organizations handling crypto.com credentials should educate users about unsolicited investment offers that reference “Hyip Investment Platform” and verify that any legitimate communications originate from official crypto.com domains. Ongoing vigilance is advised, as the low trust scores and partial vendor detections suggest the underlying kit may be reused in other campaigns.