fincrests[.]org

This domain is flagged for elevated-risk brand impersonation, specifically targeting Google users with deceptive credential harvesting tactics. Analysis indicates the infrastructure was designed to mimic legitimate Google services, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain fincrests.org was registered on March 10, 2025, through Dynadot LLC and resolves to the IP address 198.12.66.123. Security vendor assessments show 7 out of 95 engines on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100 and Scamadviser rated it 35/100. The domain appears on at least one security blocklist and was previously blocked by PhishDestroy. The page title, 'Fincrests - Home,' does not align with Google's branding, further confirming the impersonation attempt. Mitigation requires immediate action from security teams and end users. Network administrators should block the domain and its resolving IP (198.12.66.123) at the firewall or DNS level to prevent access. Users who interacted with the domain should reset credentials for any accounts accessed during the exposure window, particularly Google-related services. Security awareness training should emphasize recognizing brand impersonation tactics, such as mismatched page titles, suspicious domain registrars, and low trust scores from reputable sources. Organizations should monitor for indicators of compromise, including unusual login attempts or unauthorized access to Google Workspace environments.