949837crypto[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Crypto.com. Registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains active as of July 12, 2026. Infrastructure analysis reveals the domain resolves to IP address 172.67.183.72, hosted by Cloudflare, Inc. in the CA region, with nameservers raphaela.ns.cloudflare.com and rocco.ns.cloudflare.com. The page title returned is '949837crypto.com | 502: Bad gateway', and the HTTP status is 502, indicating the site may be temporarily unavailable or intentionally serving an error page to evade detection. VirusTotal detection data shows 5 of 91 security vendors flag the domain as malicious, and it appears on one security blocklist. AlienVault OTX includes the domain in one threat intelligence pulse, confirming its presence in analyst-observed campaigns. The SSL certificate is issued by Google Trust Services (WE1). The technology stack detected includes Node.js, React, Next.js, Express, Cloudflare Browser Insights, Cloudflare, Webpack, and HTTP/3, suggesting sophisticated infrastructure capable of serving dynamic phishing content. The Gridinsoft trust score of 0/100 and blocking by PhishDestroy further corroborate the malicious classification. While the exact phishing page content is not captured due to the 502 error, the domain name directly impersonates Crypto.com for brand confusion. Defenders should block the domain at DNS and email gateway levels, monitor for related subdomains or IPs, and report to relevant hosting providers. Users should be warned not to interact with the domain, as it may attempt credential harvesting or other data theft once active. Continued monitoring is advised given the active status and low detection rate.