cryptomaza[.]life

The domain cryptomaza.life is currently listed as active and associated with a generic phishing operation. The site delivers a page titled “PaymentBoss — Надёжный P2P-эквайринг для бизнеса | 2026”, suggesting a fraudulent attempt to impersonate a payment service. The domain was registered on 24 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑hosted address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. SSL termination is provided by Google Trust Services (certificate issued by WE1), indicating the use of a valid TLS certificate to increase credibility. DNS is served by the Cloudflare nameservers salvador.ns.cloudflare.com and olivia.ns.cloudflare.com, and the site supports HTTP/3. Infrastructure analysis shows the domain appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0 out of 100, reflecting a high risk assessment. VirusTotal scans reported that 2 of 93 security vendors flagged the domain, reinforcing the suspicion. An HTTP 521 response is observed, which typically denotes that the origin server is refusing connections, a pattern often seen when phishing sites are taken down or are intermittently inaccessible. The available evidence confirms that cryptomaza.life is being used for phishing, but the exact content of the landing page and the credential‑harvesting mechanisms have not been publicly disclosed. Defenders should block the domain at network perimeter and DNS layers, monitor for any outbound connections to the associated IP, and consider adding the domain to internal threat‑intel feeds. Continued observation of the IP reputation and periodic rescans are advised to detect any changes in malicious activity.