cryptomus[.]ltd

The domain cryptomus.ltd has been identified as a phishing infrastructure designed for brand impersonation, specifically targeting users of the cryptocurrency exchange Bitget. Analysis confirms the domain is currently offline, though prior activity involved presenting a fraudulent interface under the page title 'Cryptomus Exchange | Crypto Invoice,' mimicking legitimate cryptocurrency payment and exchange services. The threat type is classified as brand impersonation, a tactic commonly employed to deceive users into disclosing credentials or transferring funds under false pretenses.

Technical indicators reveal multiple red flags. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026, an unusually future-dated registration likely intended to evade immediate scrutiny. It resolves to the IP address 104.21.82.10, a Cloudflare-associated address often used to obscure hosting origins. Detection metrics show 14 of 95 security vendors on VirusTotal flagged the domain as malicious, while Scamadviser assigned a trust score of 31 out of 100, and Gridinsoft rated it 0 out of 100. The domain appears on one security blocklist and is referenced in a single threat intelligence pulse on AlienVault OTX. These indicators collectively suggest a low-reputation, high-risk infrastructure.

Current status indicates the domain has been taken offline, likely in response to detection and mitigation efforts. However, the infrastructure may resurface under altered domains or IP configurations. Organizations and users are advised to implement proactive measures, including blocking the domain and associated IP at network perimeters, updating endpoint detection rules to include known indicators of compromise, and conducting user awareness training to recognize brand impersonation tactics. Monitoring for newly registered domains with similar naming conventions or hosting patterns is recommended to preempt potential resurgence of this campaign.