4342-crypto[.]com

Analysis on 4342-crypto.com indicates that the domain was registered on March 06, 2026 through Hello Internet Corp and immediately pointed to the Cloudflare edge address 172.67.128.41, which belongs to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented, confirming the absence of HTTPS protection. The HTTP response currently returns an offline status, suggesting the site has been taken down, but the infrastructure remains observable. The page title returned from the host is “Crypto.com”, matching the declared brand target and confirming intent to impersonate the legitimate Crypto.com service.

The domain is listed on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a crypto‑related scam. VirusTotal scans show that two of ninety‑four AV engines flagged the domain, providing additional corroboration of malicious intent. Nameserver records are hosted on Cloudflare (cartman.ns.cloudflare.com, sasha.ns.cloudflare.com), a common choice for phishing operators seeking rapid deployment and DDoS mitigation. The combination of brand impersonation, use of a reputable CDN, lack of SSL, and blocklist presence aligns with known crypto‑drain campaigns.

However, the offline status limits immediate observation of payload delivery mechanisms, and no sample of the landing page content or credential‑harvesting forms has been captured, leaving the exact attack vector uncertain. Defenders should continue to block the domain at perimeter filters, update URL filtering lists with the observed indicators, and monitor for any re‑activation of the host. Incident response teams should also query Cloudflare logs for any recent request spikes tied to the IP address, and consider adding the domain to internal threat intel feeds. Ongoing vigilance is advised because the underlying infrastructure can be repurposed for future impersonation attempts.