crpto[.]shop

crpto.shop is flagged as an active investment‑scam phishing site. The page title observed at the host is “Unlock Finance Success with AMLTestWallet”, indicating an attempt to lure victims with promises of financial gain related to a wallet service. The domain resolves to the Cloudflare‑hosted IP address 188.114.96.3, which is geolocated to Canada. Cloudflare services are used for DNS (penny.ns.cloudflare.com, scott.ns.cloudflare.com) and web delivery, including HTTP/3 and Cloudflare Browser Insights. The site runs a modern JavaScript stack – Node.js with Vue.js and Nuxt.js – and loads third‑party libraries such as SweetAlert2 and jsDelivr, suggesting a typical front‑end phishing kit.

SSL is provided by Google Trust Services under the WE1 certificate, confirming that HTTPS is enforced despite the malicious intent. An HTTP GET returns status code 403, which may be used to obscure content from casual browsers while still serving malicious payloads to scripted requests. The domain was registered on 23 March 2026 through Global Domain Group LLC and has already appeared on three security blocklists, being actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows five of ninety‑four AV engines flag the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing its malicious reputation. The classification “Investment Scam” is supplied by the intelligence feed, though the exact mechanics – whether it harvests credentials, redirects to a payment portal, or deploys malware – have not been publicly disclosed.

Defenders should add crpto.shop to URL filtering and DNS sinkhole rules, enforce blocklist updates that include PhishDestroy, MetaMask, and SEAL, and monitor outbound traffic for connections to 188.114.96.3. Because the site uses Cloudflare’s infrastructure, standard IP reputation checks may be insufficient; correlation with the domain’s registration date and the observed page title can improve detection.