giftcrypto[.]com

Analysis of giftcrypto.com shows a newly registered domain created on 21 February 2026 that is actively hosting a Crypto.com brand impersonation campaign. The site resolves to the IPv6 address 2606:4700:3108::ac42:28b3, which belongs to Cloudflare (AS13335) and is geolocated in the United States. Registrant information indicates Dynadot LLC as the registrar, and the authoritative name servers are ns1.afternic.com and ns2.afternic.com. The TLS certificate is issued by GoDaddy Secure Certificate Authority – G2, confirming the use of a legitimate‑looking SSL chain. Infrastructure fingerprints reveal a stack built on Node.js with Envoy and Express, HTTP Strict Transport Security (HSTS) enabled, and traffic accelerated through Akamai. The HTTP response code is 200, indicating the page is reachable. Threat intelligence flags the domain as a high‑risk crypto scam; it impersonates Crypto.com and is classified as a brand‑impersonation vector. The domain is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal reports a single positive detection out of 93 scanned vendors, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Although the exact page content has not been examined, the combination of brand targeting, malicious infrastructure, and low trust scores warrants immediate defensive action. Organizations should add giftcrypto.com to deny lists, monitor outbound DNS queries for the associated IP range, and enforce web filtering rules that block access to the domain. Continuous observation of related traffic patterns and periodic re‑scanning are recommended to capture any evolution of the threat.