prostavive-up[.]com

PhishDestroy identifies prostavive-up.com as a live crypto credential theft domain currently under investigation. This domain employs generic phishing tactics targeting cryptocurrency users, with no detections on VirusTotal despite active status. The infrastructure relies on a Google Trust Services SSL certificate while resolving to IP 172.67.146.48, registered through Fewmoretaps OU d/b/a Trustname.com on October 19, 2025. This combination of trusted certificate issuance, unflagged reputation, and recent creation suggests an emerging threat actively evading detection. This domain presents a moderate but evolving risk due to its stealthy deployment and lack of blocklist coverage. With 2/95 VirusTotal detections, no reported phishing URLs, and no known associations with major brands, the threat actor appears to be testing infrastructure with minimal footprint. The use of Google Trust Services certificates adds legitimacy to phishing lures, while the IP address 172.67.146.48 belongs to Cloudflare's infrastructure, complicating direct takedown efforts. Domain registration via Trustname.com's Fewmoretaps OU indicates possible bulk registration patterns common in disposable phishing operations. Organizations and cryptocurrency users should treat prostavive-up.com as a high-priority threat indicator. Block the domain at DNS and network levels immediately. Flag any cryptocurrency-related credentials entered on this domain for potential compromise. Users should verify all cryptocurrency websites through official channels, avoid clicking unsolicited links, and enable multi-factor authentication on all exchange accounts. Security teams should monitor for TLS certificate issuance by Google Trust Services associated with new crypto-related domains and cross-reference with emerging threat feeds.