weloveeverythingcrypto[.]com

PhishDestroy identifies weloveeverythingcrypto.com as an active brand impersonation site targeting Crypto.com users. Registered on December 4, 2025 via NAMECHEAP INC, it resolves to IP 216.198.79.1 and is secured with a Let's Encrypt SSL certificate. The domain serves a fraudulent page titled 'Crypto News, Prices & Oracle Predictions | WeLoveEverythingCrypto,' mimicking legitimate news and price data to deceive visitors into interacting with malicious content or wallet drainers. No known drainer kit signature was detected during initial analysis, suggesting a live or evolving campaign aimed at harvesting credentials or initiating fraudulent transactions. This domain exhibits multiple suspicious technical indicators. VirusTotal shows 0/95 detection engines flagging the site as malicious at the time of analysis. The domain’s recent creation date (December 4, 2025) is atypically close to the present, raising red flags for fresh malicious registration. It is currently unblocked on Google Safe Browsing (GSB) and has not yet been widely flagged across public blocklists, increasing the risk of exposure to end users who lack updated threat intelligence. As of this report, weloveeverythingcrypto.com remains active with no known takedown or deactivation. Users are strongly advised to block access at the network level, avoid visiting the domain, and report it to security vendors and registrars. The lack of initial detection underscores the need for continuous monitoring. The remaining risk is classified as high due to the fresh registration, active hosting, and targeted brand impersonation aimed at the cryptocurrency sector. Immediate remediation is recommended.