mailserver823-crypto[.]com

On 22 July 2026 analysts observed that the domain mailserver823-crypto.com is currently offline but retains indicators associated with a brand‑impersonation campaign targeting Crypto.com. The domain was registered on 8 November 2025 through Hostinger Operations, UAB and uses the default Hostinger parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. DNS resolution points to the single IPv4 address 84.32.84.32, which belongs to AS47583 Hostinger International Limited and is geolocated to Lithuania. No TLS certificate is presented; HTTP requests receive a generic “Parked Domain name on Hostinger DNS system” title, confirming that the site is in a parked state rather than serving malicious payloads at the moment.

VirusTotal has recorded detections from three of ninety‑five scanning engines, indicating that automated scanners have identified malicious characteristics despite the domain’s parked appearance. The domain also appears on one external blocklist and is listed as blocked by PhishDestroy, reinforcing the view that threat‑intel communities consider it abusive. The reported scam type is “Crypto Scam,” and the domain explicitly impersonates the Crypto.com brand, suggesting that future iterations could host credential‑harvesting pages or payment‑redirection scripts. Uncertainty remains around the current activity level, as the offline status precludes direct observation of malicious content.

The lack of an SSL certificate and the parked page title suggest limited infrastructure, yet the presence of multiple detections implies that the domain has previously hosted or is intended to host phishing or cryptojacking assets. Defenders should continue to enforce DNS‑level blocking for mailserver823-crypto.com, monitor network traffic for connections to 84.32.84.32, and add the host to any internal phishing‑ or crypto‑scam watchlists.