crescentmpb[.]com[.]rexifirm[.]com

This domain, crescentmpb.com.rexifirm.com, operates as a high-risk brand impersonation threat targeting financial sector entities. Analysis indicates the domain mimics Crescent Metro Credit Union, presenting a fraudulent login portal under the page title 'Crescent Metro Credit Union- Your New Favorite Bank.' The intent is to deceive users into submitting sensitive credentials, including account numbers, passwords, and personally identifiable information (PII), which could lead to unauthorized account access, financial fraud, or identity theft. The domain does not employ SSL encryption, increasing the risk of credential interception during transmission. Infrastructure analysis reveals the domain was registered on November 07, 2024, through OwnRegistrar, Inc., and resolves to the IP address 192.3.190.186, hosted on AS36352 (HostPapa, US). VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious, with Google Safe Browsing specifically classifying it as phishing. The domain appears on one security blocklist and was proactively taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. No legitimate association with the impersonated brand was identified during investigation. Users who accessed crescentmpb.com.rexifirm.com should immediately revoke any entered credentials, particularly those linked to financial accounts. Monitor all associated accounts for unauthorized transactions or suspicious activity, and enable multi-factor authentication (MFA) where available. If PII was submitted, consider placing a fraud alert or credit freeze with relevant bureaus. Network administrators should block the domain and its resolving IP (192.3.190.186) at the perimeter to prevent further exposure. Retain logs of any interactions with the domain for potential forensic analysis or reporting to relevant authorities.