go[.]crustwin[.]com

The domain go.crustwin.com is listed on one public security blocklist and is actively blocked by the PhishDestroy service. DNS resolution returns the address 172.67.141.48, an IP range that belongs to Cloudflare’s edge network, suggesting the use of a reputable content‑delivery platform for hosting. VirusTotal reports that 11 of 91 scanning engines have flagged the domain as malicious, providing multi‑vendor corroboration of hostile intent.

The threat type is recorded as generic phishing, and the internal risk rating is elevated, indicating a higher likelihood of successful credential harvesting or related abuse. No public data on page title, SSL certificate, or targeted brand have been released, leaving the exact lure and victim profile undefined. The domain remains active as of the report date, confirming ongoing operation.

Defensive recommendations include adding go.crustwin.com to DNS deny‑list policies, configuring web proxies to drop HTTP requests to 172.67.141.48, and monitoring outbound traffic for connections to this IP. Continuous re‑evaluation is advised, as further analysis may uncover additional indicators such as specific phishing page content or supporting command‑and‑control infrastructure.