crypt-tw[.]org

The domain crypt-tw.org was registered on 17 July 2026 through Fewmoretaps OU d/b/a Trustname.com and is delegated to the Cloudflare name servers coen.ns.cloudflare.com and oaklyn.ns.cloudflare.com. DNS resolution returns the address 188.114.97.3, which is the sole host observed for this domain. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one anti‑phishing service has identified it as malicious.

VirusTotal reports that the domain has been scanned by 95 AV engines, none of which returned a detection at the time of analysis; the absence of a detection does not constitute evidence of benign behavior and should be interpreted conservatively. No public SSL certificate details, HTTP response codes, or page titles have been disclosed, so the surface‑level characteristics of the hosted content remain unknown. The short interval between registration and first appearance on blocklists suggests a rapid deployment typical of opportunistic phishing campaigns, but the lack of additional telemetry limits attribution.

Defenders should add crypt‑tw.org to outbound filtering rules, monitor DNS queries for the associated IP address, and consider proactive blocking in web proxies. Continuous re‑evaluation is advised, as future scans may reveal malicious payloads or credential‑harvesting pages. Until further evidence is gathered, the domain should be treated as a high‑confidence phishing indicator.