gro58e-cryptoslate[.]com

The domain gro58e-cryptoslate.com was registered on May 13, 2026 and is currently active, returning HTTP 200 responses. It hosts a page titled “OmniPact Secures $50 Million to Advance Trust Infrastructure | CryptoSlate,” deliberately copying the CryptoSlate brand to lure visitors.

Infrastructure analysis shows the site is served over a Let’s Encrypt (E7) certificate and resolves to IP 75.2.60.5, which belongs to an AWS Global Accelerator node located in the United States. Nameservers are ariella.ns.cloudflare.com and paul.ns.cloudflare.com, indicating use of Cloudflare DNS. The site receives a Gridinsoft trust score of 0 / 100, reflecting a lack of reputation.

Threat intelligence confirms the domain is flagged for brand impersonation of CryptoSlate. Two of ninety‑five VirusTotal security vendors have marked the domain as malicious, and the domain appears on three public blocklists. It is explicitly blocked by PhishDestroy, MetaMask, and SEAL. An AlienVault OTX pulse references the domain once, providing additional corroboration of malicious intent.

While the page currently displays only a legitimate‑looking article title, no additional malicious payloads or credential‑stealing forms have been observed. The limited number of detections suggests the campaign may be in an early stage or targeting a narrow audience. Continuous monitoring is required to detect any escalation, such as the introduction of phishing forms or blockchain‑related scams.

Defenders should add gro58e-cryptoslate.com to URL filtering and DNS blocklists, enforce HTTPS inspection for traffic to the associated IP address, and monitor Cloudflare name server activity for related domains. Incident response teams should advise users to verify CryptoSlate URLs and report any suspicious redirects.