in-cryptomus[.]com

PhishDestroy identifies in-cryptomus.com as a generic phishing domain impersonating the legitimate Cryptomus Pay platform. This fraudulent site was designed to steal login credentials or sensitive financial information from unsuspecting users. The domain mimics the official Cryptomus brand to appear trustworthy, but its sole purpose is to facilitate credential harvesting or other malicious activities.

Technical analysis reveals several red flags. The domain was registered through NameCheap, Inc. and created on February 21, 2026, which is notably in the future, indicating likely data manipulation or a test environment. It resolves to IP address 216.198.79.1 and uses a Let's Encrypt/R12 SSL certificate, which provides encryption but does not guarantee legitimacy. VirusTotal shows 3 out of 95 security vendors flagging the domain, and it appears on 3 security blocklists. These indicators confirm that the domain is widely recognized as malicious.

Currently, the domain has been taken offline, mitigating immediate risk to users. However, the threat remains that similar domains may appear under different names or IPs. Users who may have interacted with this site should change any passwords entered and monitor accounts for unauthorized activity. PhishDestroy recommends always verifying URLs before entering sensitive information, especially for financial platforms like Cryptomus. Stay vigilant against future phishing attempts by checking domain creation dates and security reports.