cricfy[.]co[.]com

The domain cricfy.co.com was registered on March 11, 2026 through Moniker Online Services LLC and resolves to the IP address 172.67.211.168, which is part of AS13335 operated by Cloudflare, Inc. The site presents a page titled "CricFy TV APK v6.2 Download Watch Live T20 WC 2026" and serves a 301 redirect over HTTPS using a Google Trust Services / WE1 certificate. Nameservers ns1‑ns4.nic.co.com are configured, and the domain currently holds a Gridinsoft trust score of 0 out of 100, indicating a lack of reputation in that system.

Analysis classifies the activity as high‑risk brand impersonation targeting the "across" brand, with a focus on a cryptocurrency‑related scam. The page advertises a downloadable APK that purports to stream live cricket matches, specifically the T20 World Cup 2026, suggesting an attempt to lure users into installing malicious software. The site is already listed on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and has been flagged by these services as active. Although VirusTotal currently reports zero detections across 95 engines, the absence of detections does not mitigate the observed malicious intent.

Defenders should prioritize the immediate blocking of cricfy.co.com at network perimeter devices and update endpoint protection signatures to include the domain and its associated IP range. Continuous monitoring of DNS queries for the domain and its configured nameservers is advised, as is the inspection of outbound traffic for attempts to download APK files from this host. Incident response teams should also be aware of potential social engineering campaigns that reference the T20 World Cup 2026, as the lure aligns with the domain's displayed content. Given the active status and high‑risk classification, organizations are encouraged to share indicators of compromise with threat intelligence feeds to reinforce collective defenses against this brand‑impersonation campaign.