a[.]crypto-eth[.]net

Analysis of a.crypto-eth.net shows that the domain was registered on 23 January 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑owned address 172.67.169.228, which is associated with AS13335 in the United States. The domain is hosted on Cloudflare’s network and uses the authoritative nameservers anita.ns.cloudflare.com and jeremy.ns.cloudflare.com. No TLS certificate was presented at the time of observation, indicating that HTTPS connections are not supported. The site’s HTML title is reported as “defi-ETH”, and the domain is explicitly listed as impersonating Crypto.com in a brand‑impersonation campaign classified as a Crypto Scam. PhishDestroy has already blocked the domain, and it appears on a single external security blocklist.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans returned four positive detections out of ninety‑three submitted scanners, confirming that multiple independent engines flag the domain as malicious. The current operational status is offline, but the infrastructure components remain active and could be re‑used. Defenders should continue to enforce DNS‑level denial for the domain, add the IP address 172.67.169.228 to network‑level blocklists, and monitor for any future re‑hosting attempts under the same nameservers. Because the site does not present a valid SSL certificate, any attempt to retrieve content would occur over plain HTTP, exposing any credentials entered to passive network observers.

The combination of a zero trust score, multiple vendor detections, and explicit brand impersonation aligns with typical patterns of cryptocurrency‑focused credential harvesting. While the domain is currently offline, the underlying IP and nameserver configuration remain viable for future abuse.