cryptomus[.]best

The domain cryptomus.best is under active investigation for hosting a crypto wallet phishing campaign targeting cryptocurrency users. This threat involves impersonating the legitimate cryptocurrency payment service Cryptomus, a popular platform for crypto transactions, to deceive victims into surrendering sensitive wallet credentials or funds. This domain was flagged by PhishDestroy after VirusTotal vendors reported 0 detections out of 95 scans, indicating it remains undetected by most antivirus engines as of this analysis. The domain is registered through Dynadot LLC, resolves to IP address 104.21.66.12, and operates under a Let’s Encrypt SSL certificate. The domain was registered on March 26, 2026, and currently shows no presence on major threat intelligence blocklists. Trust scores and reputation metrics remain neutral due to its recent creation and low detection count. As the investigation continues, cryptomus.best should be treated as an active threat until further analysis is complete. Immediate defensive actions are recommended: block the domain at the DNS and network levels, inspect outbound traffic for connections to 104.21.66.12, and alert users to avoid interacting with any cryptomus.best links or forms. Users who may have entered credentials should rotate wallet passwords and enable multi-factor authentication immediately. Security teams are advised to monitor for lateral movement or credential reuse associated with this domain.