poloniexcrypto[.]cc

Analysis of poloniexcrypto.cc shows an active infrastructure that aligns with a high‑risk generic phishing operation. The domain, registered on 21 February 2026 via Gname.com Pte. Ltd., resolves to IP 104.21.28.151, which is hosted in the United States under ASN 13335, a well‑known content‑delivery network. Nameserver records (aria.ns.cloudflare.com, arturo.ns.cloudflare.com) confirm the use of a CDN service. The site returns HTTP 200 with the page title "Sorry, the website has been stopped" and employs modern web technologies including Vue.js, HSTS, HTTP/3, and browser insight scripts, indicating a deliberately crafted front‑end. Security telemetry places the domain on a single blocklist, flagged by PhishDestroy, and VirusTotal reports detections by two of ninety‑five scanning engines, reinforcing the malicious classification. The SSL certificate is issued by a public certificate authority, providing encrypted transport but not mitigating the underlying threat. The Gridinsoft trust score of 0/100 further underscores the lack of legitimacy. While the exact phishing content has not been captured, the combination of recent creation, CDN‑based hosting, detection by multiple security sources, and the page title suggest a deliberately deceptive site likely intended to harvest credentials or financial information. Defenders should block the domain at network perimeter, add it to DNS sinkhole lists, and monitor for any related traffic patterns. Incident response teams should treat any user‑initiated connections to this host as compromised and advise affected users to change credentials immediately.