crown-hub[.]com

Analysis of crown-hub.com shows a newly registered domain (creation date February 21 2026) that is being used for brand impersonation of Binance. The site resolves to IP 172.67.190.86, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by Cloudflare’s authoritative nameservers derek.ns.cloudflare.com and gene.ns.cloudflare.com. No TLS certificate was observed, indicating the site was served over plain HTTP when it was online.

The page title captured from the site reads “CrownHub - Oficiální platforma | AI‑Trading 2025 | Více než 10 000 hodnocení,” providing no direct reference to Binance but confirming the use of promotional language. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal reports that one of ninety‑three scanning engines flagged the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing its malicious classification. Registration was performed through Metaregistrar BV, a registrar known to host both legitimate and abusive domains.

The current operational status is offline, suggesting takedown or removal of content, but the infrastructure—particularly the use of Cloudflare’s edge network—remains reusable for future impersonation campaigns. Defenders should continue to block the domain and its associated IP address at perimeter controls, monitor for any re‑registration of similar names, and consider adding the domain to internal threat intel feeds. Ongoing observation of Cloudflare‑originated IP ranges that host impersonation sites is advised, as the attacker may replicate this pattern with new domains. Evidence sources include the resolved IP, registrar data, blocklist entry, PhishDestroy block, VirusTotal detection, and Gridinsoft trust score.