upex-crypto[.]com

This domain, upex-crypto.com, is identified as a brand impersonation threat designed to deceive users of the legitimate cryptocurrency platform Crypto.com. The site presents itself as a cryptocurrency exchange under the name UPEX CRYPTO, using a nearly identical interface to trick victims into entering sensitive credentials, such as login details or wallet recovery phrases. Once obtained, these credentials can be exploited to drain cryptocurrency assets from victims' wallets or gain unauthorized access to their accounts. The threat extends beyond financial loss, as compromised accounts may also be used for further malicious activities, including spreading phishing links or laundering illicit funds. Analysis indicates that upex-crypto.com was registered on April 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 172.67.183.98 and is currently offline, though this does not eliminate the risk of re-emergence under a similar or altered infrastructure. Detection data from VirusTotal reveals that 5 out of 95 security vendors have flagged this domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The site's infrastructure leverages technologies such as Node.js, Vue.js, Nuxt.js, and Nginx, alongside Cloudflare services, which are often employed to obfuscate the true origin of malicious traffic and evade detection. Users who have visited upex-crypto.com or interacted with its content are advised to take immediate action to mitigate potential risks. First, revoke any active sessions or authorizations granted to third-party applications linked to the domain. Next, change passwords for all cryptocurrency-related accounts, particularly those associated with Crypto.com, and enable multi-factor authentication if not already active. Monitor account activity for unauthorized transactions and report any suspicious behavior to the legitimate platform. If sensitive information such as wallet recovery phrases or private keys was entered, consider transferring assets to a new, secure wallet. Finally, scan local devices for malware, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate data.