cxrptocmlogin[.]webflow[.]io

cxrptocmlogin.webflow.io is an actively operating domain identified as engaging in brand impersonation phishing, specifically targeting the cryptocurrency service Crypto.com. This domain is currently classified as a threat under the seed 0df02a with an elevated risk level, indicating ongoing malicious activity aimed at deceiving users. This domain was flagged by 16 of 95 VirusTotal security vendors, demonstrating a significant detection rate among industry tools. The domain resolves to the IP address 104.18.36.248 and uses a Google Trust Services SSL certificate. While the registrar and creation date details are not explicitly provided, the domain's active status and trust scores suggest it is a recent or freshly repurposed entity. The combination of high VirusTotal flagging and SSL certificate issued by a reputable provider highlights the domain's deceptive nature. Users and researchers are advised to avoid interacting with cxrptocmlogin.webflow.io due to its confirmed malicious intent. Security teams should block this domain at the network and endpoint levels. Additionally, users who may have entered credentials on this site should immediately change their Crypto.com account passwords and enable two-factor authentication. Report this domain to relevant threat intelligence platforms to aid in broader mitigation efforts.