crestway[.]org

Analysis confirms crestway.org as a confirmed phishing domain impersonating Google, specifically designed for tech-support scam activity. The domain was registered on February 21, 2026, and resolved to IP address 192.3.141.252, hosted on AS36352 (HostPapa) in the United States. At the time of assessment, the domain has been taken offline, though it remains flagged by one security blocklist and was previously blocked by PhishDestroy. The Gridinsoft trust score for this domain is 0 out of 100, indicating high risk.

The page title, 'Home | Mobile Banking, Credit Cards, Mortgages, Auto Loan,' does not align with the identified scam type or brand impersonation, suggesting either a generic template or misdirection to obscure the actual intent. The SSL certificate is classified as R13, which may indicate a low-trust or misconfigured certificate, a common trait in phishing infrastructure. Four out of 93 security vendors on VirusTotal flagged this domain as malicious, providing additional confirmation of its threat status.

While the domain is currently offline, defenders should treat any future resolution or reappearance of crestway.org as a high-priority threat. Recommended actions include blocking the domain and associated IP (192.3.141.252) at the network level, monitoring for related domains registered under the same ASN or hosting provider, and alerting users to the tech-support scam classification. No further details about the phishing kit or exact user interaction flow are available at this time, as the site content was not captured prior to takedown.