cryptoskyrim[.]com

The domain www.cryptoskyrim.com was registered on June 30, 2025 through Global Domain Group LLC and currently resolves to the IP address 137.220.152.47, which belongs to ASN 4907 (BGPNET PTE. LTD.) and is geolocated in Hong Kong. The site delivers an HTTP 200 response and hosts no SSL certificate, exposing traffic to potential interception.

The page title reported as CRYPTOSKYRIM aligns with a brand‑impersonation campaign that claims to mimic Google, as indicated by the intelligence tag “Impersonates: Google.” Gridinsoft assigns the domain a trust score of 1 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows a single detection out of ninety‑five scanners, confirming that at least one security vendor classifies the domain as malicious. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy service, while AlienVault OTX lists it in one threat‑intel pulse.

Nameserver configuration uses becky.ns.cloudflare.com and conrad.ns.cloudflare.com, both Cloudflare‑managed, suggesting the attacker is leveraging a reputable DNS provider to increase availability. Defenders should immediately add www.cryptoskyrim.com and its associated IP 137.220.152.47 to network and endpoint blocklists, monitor for any outbound connections to the host, and enforce HTTPS‑only policies to mitigate exposure to unencrypted traffic. Continued surveillance of the Cloudflare nameservers for any future changes is advised, as well as periodic re‑scanning with VirusTotal and other telemetry sources to capture additional detections that may arise as the campaign evolves.