netwrkcrypto[.]xyz

The domain netwrkcrypto.xyz was observed on 2026-08-07 as part of an active generic phishing campaign. Infrastructure analysis shows the hostname resolves to the IPv4 address 104.21.21.166, which is the sole publicly visible endpoint. The address is hosted on a content delivery network that frequently serves unrelated legitimate traffic, making attribution through the IP alone ambiguous. VirusTotal records indicate that the domain has been submitted to the service and examined by 91 independent scanning engines; none of the engines currently report a malicious classification.

While the lack of detections does not constitute assurance of benign intent, it demonstrates that automated signatures have not yet identified the domain as malicious. The domain is listed on a single external security blocklist and is actively blocked by the PhishDestroy sinkhole, confirming that at least one threat‑intelligence feed has correlated the host with phishing activity. No additional metadata such as registrar information, creation date, SSL certificate details, HTTP response codes, or page title is available in the current intelligence set, leaving the broader operational profile of the campaign uncharacterized.

Consequently, defenders should continue to monitor traffic to the IP address and enforce existing phishing mitigation controls. Adding the domain to local blocklists, employing DNS‑based filtering, and instrumenting network telemetry for connections to 104.21.21.166 are recommended short‑term actions. Ongoing collection of payload samples, request headers, and any observed redirects will be necessary to refine the risk assessment and to enable signature development for downstream detection mechanisms.