chaincrestfin[.]com

chaincrestfin.com was registered through Dynadot LLC on 17 August 2025 and is currently resolved to the IPv4 address 198.12.80.250, which belongs to AS36352 (HostPapa) located in the United States. The domain uses the authoritative name servers dns1.safedatahost.cloud and dns2.safedatahost.cloud and does not present an SSL/TLS certificate, indicating that any HTTP traffic would be unencrypted. The sole page title returned from the live site is the domain name itself, “chaincrestfin.com”, and no further content has been captured. VirusTotal analysis shows that two of ninety‑five scanning engines flagged the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, reflecting a high likelihood of malicious intent.

The domain appears on a single external blocklist, PhishDestroy, which has already taken it offline. The listed scam type is “Brand Impersonation” and the target brand is identified as “across”. No additional intelligence such as phishing kit fingerprints, compromised credentials, or payload hashes is available, and the site’s HTTP response code and content have not been archived. The combination of a recent registration date, low‑reputation hosting, lack of encryption, and multiple independent detections suggests an elevated risk that the domain was used to harvest credentials or deliver fraudulent content impersonating the across brand.

Defenders should immediately add 198.12.80.250 and the domain name to network‑level deny lists, enforce TLS inspection for outbound HTTP to detect potential clear‑text exfiltration, and monitor for new domains registered with the same name servers or hosting provider. Continuous observation of DNS queries for the domain and periodic rescans with multi‑engine services are recommended to capture any re‑activation or changes in the payload.