crypticalfund[.]ltd[.]zetashares[.]com

Analysis of crypticalfund.ltd.zetashares.com, observed on July 24 2026, indicates that the domain is currently offline but was previously flagged as a brand‑impersonation campaign targeting Ethereum. The site was registered through GoDaddy.com, LLC on 15 July 2025 and uses the nameservers ns1.host-forest.com and ns2.host-forest.com. DNS resolution points to IP address 198.12.66.123, which belongs to AS36352 (HostPapa) and is geolocated in the United States. No TLS certificate was presented, meaning the site operated without HTTPS protection. The page title returned by the HTTP response was “Crypticalfund.org”, which does not align with the domain name and further suggests deceptive intent.

Reputation services have identified the domain on at least one security blocklist; PhishDestroy explicitly blocks it, and two of ninety‑five VirusTotal scanners raised detections. Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious behavior. The combination of brand impersonation labeling, low trust score, blocklist presence, and lack of encryption is consistent with a phishing or scam infrastructure. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no sample page content or malware kit has been disclosed.

The offline status prevents real‑time verification of the site’s current behavior. Defenders should continue to block the domain at network perimeter and DNS filtering layers, monitor for any resurgence of the host or sibling subdomains, and consider adding the associated IP address to deny lists. Incident response teams encountering references to crypticalfund.ltd.zetashares.com should treat any associated email or credential submissions as suspicious and advise affected users to change Ethereum‑related passwords and keys. Ongoing observation of the registrar and hosting provider may reveal additional domains employing the same infrastructure.