crew-vip[.]com

The domain crew-vip.com returned an HTTP 200 response, indicating that a web service is actively hosted. Infrastructure analysis shows the domain is served through Cloudflare’s DNS network, using the authoritative name servers dolly.ns.cloudflare.com and langston.ns.cloudflare.com. Registration details reveal the domain was created through the HOSTINGER operations, UAB registrar, a commonly used provider for short‑lived malicious sites.

The domain appears on a single security blocklist and is currently blocked by the PhishDestroy feed, confirming that at least one external threat‑intel source has classified it as malicious. VirusTotal reports indicate that the site was scanned by 91 antivirus and URL‑reputation engines; none of the engines raised a detection, but the absence of a flag does not constitute evidence of safety, especially given the other corroborating indicators. No additional context such as a page title, targeted brand, or specific phishing kit was supplied, so the precise luring technique remains unknown.

The available evidence points to a generic phishing operation that is still active as of the report date, July 25 2026, and is under investigation. Defenders should add crew‑vip.com to deny‑list rules at perimeter and endpoint controls, monitor DNS queries for the associated Cloudflare nameservers, and continue to track any future detections from additional blocklists or reputation services. Ongoing observation of the domain’s hosting patterns and any changes in its content or traffic volume is recommended to promptly adjust mitigation measures should the campaign evolve.