crypto[.]trustedweb[.]pro

Analysis of crypto.trustedweb.pro indicates a brand‑impersonation campaign targeting Crypto.com. The site presented the page title ElitecryptoFX, suggesting an attempt to lure cryptocurrency‑interested users. Infrastructure inspection shows the domain resolves to 198.23.193.170, an address hosted by HostPapa (AS36352) in the United States. Registration details list the registrar as CC-198-23-193-168-29, also tied to ASN 36352, confirming the same hosting provider. No TLS certificate was observed; the site operated without HTTPS, which is atypical for legitimate financial services and may facilitate man‑in‑the‑middle interception. Detected web technologies include LiteSpeed and HTTP/3, indicating a modern web server stack despite the lack of encryption.

Reputation signals are uniformly negative: Gridinsoft assigned a trust score of 0 / 100, and PhishDestroy has actively blocked the domain. The domain appears on a single security blocklist, and VirusTotal reports that 6 of 95 scanned security vendors flagged it as malicious, reinforcing the suspicion that the site hosts phishing or fraudulent content. The brand‑target field explicitly names Crypto.com, confirming that the campaign’s objective is to deceive Crypto.com customers.

The current operational status is offline, which suggests the phishing infrastructure has been taken down or is no longer in use. Nonetheless, defenders should retain the domain in blocklists and monitoring feeds because the underlying infrastructure (same IP range and hosting provider) may be repurposed for future campaigns. Continuous observation of the hosting AS, reverse‑DNS entries, and any new subdomains under the same registrar is recommended. Organizations that rely on Crypto.com should update URL filtering policies to deny connections to crypto.trustedweb.pro and any future look‑alike domains. Incident response teams should also correlate any authentication attempts against Crypto.