cricfytv[.]com[.]in

Analysis of cricfytv.com.in, observed on July 24, 2026, indicates a high‑risk, active phishing infrastructure. The domain was registered through the National Informatics Centre on February 21, 2026 and resolves to the IP address 185.196.220.16, which is assigned to AS213438 ColocaTel Inc. in Germany. The site presents a valid TLS certificate issued by Let’s Encrypt (R12) and returns HTTP 200 responses, suggesting the server is fully operational. The page title retrieved from the live host reads "Cricfy TV APK v5.8 Download Application Watch Live Cricket Match for Android 2026," implying the site is offering a downloadable Android application that purports to stream live cricket matches. Underlying technologies identified include WordPress, MySQL, PHP, Yoast SEO, LiteSpeed, and HTTP/3, all common components for a content‑focused site.

Security telemetry shows that seven out of ninety‑three VirusTotal scanners flagged the domain, and the Gridinsoft trust score is 0 / 100, reflecting a strongly malicious reputation. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment of phishing activity. MX records list the domain itself as the mail exchanger, a pattern often used to facilitate fraudulent email campaigns.

While the available data confirms the presence of phishing‑related indicators, details such as the exact phishing kit, credential collection methods, or victim targeting patterns remain unknown due to limited public visibility of the site’s content. Defenders should prioritize immediate mitigation: block cricfytv.com.in at DNS and proxy layers, add its IP address 185.196.220.16 to firewall deny lists, and ensure email gateways reject messages originating from the domain’s MX record. Continuous monitoring of related IP ranges and the AS213438 prefix is advised, as threat actors frequently reuse hosting infrastructure.