receiving-cryptomus[.]com

Analysis of www.receiving-cryptomus.com indicates that the domain was registered on February 21, 2026 through Ultahost, Inc. and is hosted on Amazon Web Services (AS16509) with the IPv4 address 13.248.244.96 located in the United States. The site served a page titled "Payment - Cryptomus" and is classified as a Banking Phishing campaign targeting users of the Cryptomus platform. No TLS certificate was observed, meaning the site operated without HTTPS protection. The domain is currently offline, and the hosting provider’s IP address is listed on a single security blocklist.

Independent scanning on VirusTotal returned detections from three of ninety‑three antivirus engines, confirming malicious activity. The domain was also flagged by the PhishDestroy blocklist. Nameserver records point to ns1‑ns4.ultahost.com, consistent with the registrar information.

While the exact phishing kit or credential harvesting method has not been disclosed, the combination of a payment‑related page title, lack of encryption, and vendor detections strongly suggests a credential‑stealing landing page. Defenders should continue to block the domain at perimeter firewalls and DNS filters, monitor for outbound connections to the associated AWS IP, and update any endpoint detection signatures to include the observed VirusTotal hashes. Incident response teams should also advise users to verify any unsolicited payment requests from Cryptomus through official channels and to report attempted credential submissions to the appropriate security team.