cryptomus[.]tw

Analysis of the domain cryptomus.tw indicates a high-risk phishing threat targeting cryptocurrency users. Registered on May 24, 2026, through GNAME.COM, the domain remains active as of July 12, 2026, resolving to the IP address 104.21.90.143. The domain is secured with a Let's Encrypt SSL certificate, a common tactic among threat actors to mimic legitimacy and evade basic security warnings. While the certificate itself does not indicate malicious intent, its use in this context aligns with observed patterns in phishing infrastructure. The domain is flagged by 5 out of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect either the sophistication of the campaign or its recent deployment. More notably, cryptomus.tw appears on two security blocklists—PhishDestroy and BLP-Malware—and is referenced in 16 threat intelligence pulses on AlienVault OTX, suggesting broader recognition within the security community. The Gridinsoft trust score of 0/100 further corroborates its classification as malicious, though the specific techniques or payloads associated with the domain remain unverified in public sources. Infrastructure analysis reveals no additional context about the hosting provider or autonomous system number (ASN), limiting attribution efforts. The domain's name, cryptomus.tw, closely resembles legitimate cryptocurrency services, a tactic designed to exploit user familiarity and trust. Defenders should treat this domain as actively malicious and prioritize blocking it at the DNS or proxy level. Network logs should be reviewed for connections to 104.21.90.143 or subdomains of cryptomus.tw, particularly in environments where cryptocurrency transactions or wallet interactions occur. Given the domain's recent registration and ongoing activity, monitoring for related domains or IP shifts is recommended to preempt potential evasion attempts.