crystal-miner[.]com

On July 24, 2026, analysis of crystal-miner.com indicates the site was used to host a fraudulent Wells Fargo login page, as reflected by the page title “Wells Fargo – Sign On”. The domain was registered on 20 October 2025 through Cloudflare, Inc. and is served from the Cloudflare network (AS13335) at IP address 104.21.23.111, located in the United States. DNS resolution uses the Cloudflare nameservers mitch.ns.cloudflare.com and raina.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming a valid SSL chain but offering no assurance of legitimacy. HTTP requests to the host return a 403 status code, suggesting the content is being blocked or the site is no longer serving pages; the domain is currently taken offline. VirusTotal records show that 16 of 91 scanned security vendors flagged the domain, indicating a moderate level of detection across multiple engines.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the site appears on one external blocklist, reinforcing the malicious assessment. PhishDestroy has also listed the domain as blocked. The combination of a brand‑specific page title, multiple vendor detections, and inclusion on reputable blocklists points to a targeted credential‑harvesting campaign against Wells Fargo customers. Uncertainty remains regarding the exact phishing kit or any additional infrastructure such as command‑and‑control servers, as no further samples or URLs have been released.

The 403 response prevents direct observation of the page content, and no malware payloads have been associated with the domain to date. Defenders should add crystal-miner.com to URL filtering and email security policies, block the associated IP address 104.21.23.111 at the network perimeter, and monitor for similar domains that resolve to Cloudflare infrastructure with the same nameservers.