cryptocas[.]top

Analysis of the domain cryptocas.top indicates a brand impersonation campaign targeting Ethereum users, classified as elevated risk and currently offline. The domain was registered on August 18, 2025, through Web Commerce Communications Limited and resolves to the IP address 57.129.97.29, hosted on AS16276 (OVH SAS) in Germany. Infrastructure analysis reveals Cloudflare nameservers (naya.ns.cloudflare.com and sean.ns.cloudflare.com) and the absence of an SSL certificate, increasing susceptibility to interception or tampering. The page title, 'CRYPTOCAS | Enter the world of sport and stakes!', suggests an attempt to lure users with gambling or betting themes, though the exact content and functionality remain unconfirmed due to the domain's offline status as of July 22, 2026.

Detection data is limited but indicative of malicious intent: the domain appears on one security blocklist (PhishDestroy) and was flagged by a single vendor on VirusTotal, though the specific detection context is not detailed. No additional trust scores, Safe Browsing results, or Open Threat Exchange (OTX) records are available. The scam type is explicitly labeled as brand impersonation, aligning with the use of Ethereum's reputation to deceive targets.

Defenders should treat this domain as confirmed malicious, block it at the DNS and proxy levels, and monitor for related infrastructure (e.g., 57.129.97.29, Cloudflare-hosted domains with similar naming patterns). Further investigation into the registrar's abuse history and potential connections to other impersonation campaigns is recommended. Given the domain's recent creation and offline status, it may resurface under altered infrastructure or renewed registration.