cryptocurrencytracingbook[.]com

The domain cryptocurrencytracingbook.com was registered through Porkbun LLC on 2026-03-06. DNS resolution points to the Amazon-owned address 44.227.65.245, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. The site presented the page title “porkbun.com | expired domain”, indicating that the domain is currently offline and likely parked. SSL was provisioned by Let’s Encrypt (R12), confirming the presence of a valid TLS certificate despite the lack of active content.

Threat intelligence records show the domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans reported five detections out of ninety‑four submitted vendors, reinforcing the suspicion of malicious use. The authoritative name servers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, and maceio.ns.porkbun.com, all hosted by the registrar’s infrastructure. Current evidence does not disclose the specific phishing payload, targeted brand, or lure technique; the public page only reflects an expired‑domain placeholder.

Consequently, confidence in the domain’s malicious intent rests on the blocklist presence, vendor detections, and its association with known phishing mitigation products. Defenders should continue to block the domain at network perimeter, monitor DNS queries for the IP 44.227.65.245, and add the domain to internal threat feeds. Ongoing observation is recommended to capture any future re‑activation that could serve a phishing campaign.