cdeposit[.]top

Cdeposit.top has been identified as an active phishing domain engaged in credential theft activities targeting cryptocurrency users. This domain poses an under investigation risk level, requiring immediate attention from SOC teams and end-users alike. The threat involves potential theft of login credentials or sensitive financial data through fraudulent deposit portals mimicking legitimate crypto services. This domain resolves to IP 172.67.186.49 and was registered through NameSilo, LLC on March 28, 2026. Security analysis shows concerning indicators, including 0 detections out of 95 VirusTotal scans and a Let's Encrypt SSL certificate that may lend false legitimacy to the site. The domain remains unflagged on major blocklists despite its active status, suggesting a potential gap in threat intelligence coverage. The low detection rate combined with its recent creation date indicates this may be a newly deployed threat with evasion techniques. Organizations and individuals should immediately block cdeposit.top at network and endpoint levels while investigating any potential exposure to this domain. For cryptocurrency users, verify all deposit addresses through multiple independent sources before transferring funds. Implement enhanced monitoring for any outbound connections to this IP range (172.67.186.49) and consider deploying browser isolation for users accessing crypto platforms. Report any observed interactions with this domain to relevant threat intelligence platforms to improve community detection capabilities.