# cream-finance-cream.com — SUSPICIOUS

> Avoid cream-finance-cream.com—this phishing site is flagged and currently offline. Stay vigilant and report suspicious domains promptly.

## Summary
PhishDestroy identifies cream-finance-cream.com as a medium-risk phishing domain impersonating financial services. It was registered recently through NICENIC INTERNATIONAL GROUP CO., LIMITED.

The domain resolved to IP 188.114.97.3 and presented a generic directory listing titled 'Index of /'. It appeared on multiple security blocklists and was flagged by a minority of security vendors, signaling potential malicious intent.

Currently, the domain is offline, following detection and blocking actions. Users and organizations should remain cautious and verify suspicious communications referencing this domain to prevent credential theft.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Page title: Index of /

## Domain Intelligence
- Registered: 2025-10-10 13:06:46
- Expires: 2026-10-10 13:06:46
- Registrar: NiceNIC International Group Co., Limited
- Country: HK
- IP: 188.114.96.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: terry.ns.cloudflare.com ximena.ns.cloudflare.com
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["CRDF", "Fortinet", "Gridinsoft"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/0199d868-c669-761d-9958-0082a8373f99.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/a03c69b4-7289-41fd-9087-d1a364215ba8
- Wayback Machine: https://web.archive.org/web/https://cream-finance-cream.com
- PhishDestroy: https://phishdestroy.io/domain/cream-finance-cream.com/
- LLM endpoint: https://phishdestroy.io/domain/cream-finance-cream.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/cream-finance-cream.com/
Last updated: 2026-03-19