crestfundgrove-app[.]net

Analysis of crestfundgrove-app.net indicates an active credential phishing domain registered on July 8, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP address 91.236.116.210 and is secured with a Let's Encrypt SSL certificate, a common tactic to appear legitimate. As of July 12, 2026, the domain remains active and has been identified in two threat intelligence pulses on AlienVault OTX, suggesting its use in broader phishing campaigns. VirusTotal detection shows two security vendors flagging the domain, though the specific nature of the threat—such as targeted brands or phishing kit—has not been confirmed through available data. The domain's infrastructure does not reveal a clear brand impersonation or scam type at this stage, and no page content analysis has been conducted. Defenders should treat this domain as high-risk due to its recent registration, active status, and presence in threat intelligence feeds. Immediate actions include blocking the domain and IP at network perimeters, monitoring for connections to 91.236.116.210, and reviewing logs for user interactions with crestfundgrove-app.net. Further investigation into associated email campaigns or redirect chains may provide additional context on the phishing operation's scope.