cryptotp[.]org

cryptotp.org was observed by multiple threat intelligence sources as a crypto‑focused phishing site. The domain was registered on 13 August 2025 through Gname.com Pte. Ltd. and is currently taken offline, but historical snapshots show the site served a page titled “Web3 Smart Contract”. The page was built with Vue.js and delivered via Cloudflare’s CDN, using HTTP/3 and Cloudflare Browser Insights. TLS termination was provided by a Google Trust Services certificate (WE1), indicating a valid SSL chain. Reputation services rate the domain poorly: Scamadviser assigns a trust score of 16 / 100, and Gridinsoft reports a score of 0 / 100.

Google Safe Browsing classifies the domain as “social engineering”, and PhishDestroy has added it to its blocklist, making the site appear on one security blocklist. VirusTotal analyses return 14 positives out of 95 scanners, confirming malicious intent. The domain resolves to 172.67.167.171, an IP owned by AS13335 Cloudflare, Inc., located in the United States, and uses the nameservers hugh.ns.cloudflare.com and liz.ns.cloudflare.com. The combination of a low reputation score, a crypto‑related page title, and multiple detections aligns with the reported “Crypto Scam” classification.

While the site is currently offline, the infrastructure—particularly the use of Cloudflare’s edge network and a valid Google‑issued certificate—suggests the operators were leveraging reputable services to increase credibility. Defenders should continue to block cryptotp.org at DNS and proxy layers, monitor for re‑registration or re‑activation, and add the observed IP and nameserver patterns to threat‑intel feeds. Network‑level alerts for outbound connections to the listed IP, especially over HTTP/3, can help detect any resurgence. Regularly updating URL filtering rules with the listed detection signatures will reduce exposure to similar crypto‑phishing campaigns.