115224-crypto[.]com

The domain 115224-crypto.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited. It resolves to the IPv6 address 2606:4700:3035::ac43:b412, which is announced by AS13335 Cloudflare, Inc., and the authoritative nameservers are jillian.ns.cloudflare.com and lakas.ns.cloudflare.com. The site is served behind Cloudflare’s edge network and responds over HTTP/3.

The TLS certificate presented by the site is issued by Google Trust Services / WE1, indicating a legitimate certificate chain but not confirming the legitimacy of the content. An HTTP request returns status code 200, yet the page title reports “115224-crypto.com | 521: Web server is down”, suggesting a misconfiguration or intentional error page. Automated analysis flags the domain with a Gridinsoft trust score of 0/100 and a VirusTotal detection of 2 out of 95 scanners, placing it on at least one public blocklist and confirming it as a known threat.

Analysis classifies the site as a brand‑impersonation campaign targeting Crypto.com users. The scam type is identified as cryptocurrency, and the domain explicitly mirrors the victim brand in its name. The combination of a recent registration, Cloudflare‑based hosting, a legitimate‑looking SSL certificate, and the low trust score aligns with typical high‑risk phishing infrastructure designed to harvest credentials or lure victims into fraudulent crypto transactions.

Defenders should add 115224-crypto.com to URL filtering and DNS block lists, monitor for any outbound connections to the associated IPv6 address, and enforce strict email authentication for messages claiming to originate from Crypto.com. Continuous re‑scanning of the domain is advised, as threat actors may alter hosting or certificate details over time. Incident response teams should treat any user reports involving this domain as high priority and advise affected users to change Crypto.com credentials immediately.