buycrypto[.]top

The domain buycrypto.top was a generic phishing site targeting users seeking cryptocurrency purchases in Russian rubles. It posed an elevated risk of credential theft or financial fraud by presenting itself as a legitimate platform for buying cryptocurrency, though it impersonated no specific brand and did not deploy a known drainer kit. As of the latest verification, buycrypto.top has been taken offline, but prior activity classified it as a phishing threat.

Technical indicators confirm the malicious nature of buycrypto.top. The domain was flagged by 2 of 95 VirusTotal security vendors, including Bfore.Ai PreCrime and SOCRadar, and appeared on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through NameSilo, LLC on February 22, 2026, it resolved to the IP address 87.236.16.254, hosted by Beget LLC in Russia (AS198610). No SSL certificate was issued, and the observed page title was 'Купить криптовалюту за рубли в России с карты или другими способами'. The domain’s Scamadviser trust score was 12 out of 100, further indicating its fraudulent intent.

Users who interacted with buycrypto.top should immediately change any credentials entered on the site and enable two-factor authentication on all financial and cryptocurrency accounts. Monitor accounts for unauthorized transactions or signs of fraud. Report the domain to relevant platforms, including Google Safe Browsing, anti-phishing organizations, and the registrar (NameSilo, LLC), to aid in takedown efforts and prevent further victimization.