royalcrest-lorin[.]org

The domain royalcrest-lorin.org was registered on 2026-03-06 through NameCheap, Inc. and delegated to the Cloudflare nameservers vivienne.ns.cloudflare.com and wesley.ns.cloudflare.com. DNS resolution points to the IP address 172.67.131.194, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E8), indicating that HTTPS was available at the time of observation. The page title retrieved from the site reads “Royalcrest Lorin — Official, Trusted Cryptocurrency Trading Platform with AI Autopilot and Security,” and the intelligence categorises the offering as a “Fake Exchange,” a form of generic phishing targeting cryptocurrency users.

VirusTotal reported a single positive detection out of ninety‑five submitted scanners, demonstrating that at least one security vendor identified malicious behavior. The domain is listed on three public blocklists—PhishDestroy, MetaMask, and SEAL—further confirming its malicious reputation. Current monitoring shows the service has been taken offline, which is reflected in the “offline” status field.

No additional forensic artifacts such as JavaScript payloads, credential‑stealing forms, or redirects were captured, so the exact attack vector remains unverified. Defenders should continue to enforce network‑level blocks against the domain and its associated IP address, add the domain to internal phishing detection rules, and monitor for any re‑hosting attempts that might appear on alternative IP ranges or new certificates. Ongoing vigilance is advised, especially for users of cryptocurrency wallets and AI‑driven trading platforms, as the threat actor may attempt to replicate the same branding on a different infrastructure.