getcryptotab[.]com

This domain, getcryptotab.com, is confirmed as an active phishing site impersonating Facebook, classified as brand impersonation with a high risk level. The domain was registered on December 26, 2017, through NameCheap, Inc., and resolves to the IPv6 address 2606:4700:3030::6815:3001. The page title, 'Get CryptoTab - Easy way for Bitcoin Mining,' suggests a cryptocurrency mining theme, but the brand target is Facebook, indicating the site likely misleads visitors into believing it is affiliated with Facebook for credential harvesting or other fraudulent purposes. Security analysis shows the domain is blocked by four blocklists: BLP-Crypto, PhishDestroy, BLP-Fraud, and Hagezi. Gridinsoft has assigned a trust score of 0 out of 100, reflecting high suspicion. VirusTotal reports 3 out of 95 security vendors flag this domain as malicious, and AlienVault OTX indicates its presence in 26 threat intelligence pulses, signifying broad recognition in security communities. The domain uses SSL certificates from Google Trust Services and employs technologies including Cloudflare, Cloudflare Browser Insights, HTTP/3, HSTS, Google Analytics, and YouTube integration. The exact visual content or login form of the page has not been analyzed, but the combination of blocklist presence, low trust score, and vendor detections confirms malicious intent. Defenders should block access to this domain and any subdomains, monitor for related infrastructure under the same registrar or IP range, and educate users about phishing campaigns leveraging cryptocurrency mining as a lure. The domain remains active as of July 12, 2026, requiring ongoing vigilance.