crescendoav[.]in

PhishDestroy identifies crescendoav.in as an active brand-impersonation scam site masquerading as a security vendor. The domain delivers a fake antivirus installer that exfiltrates user credentials under the guise of activating a product license. Current threat status is classified as active. crescendoav.in was registered through GoDaddy on April 24, 2018 and resolves to IPv4 97.74.94.175. The GoDaddy-issued SSL certificate (common name *.crescendoav.in) shows a trust score of 98.8 on VirusTotal and has not been flagged by any of the 95 scanning engines, yielding a current detection rate of 6 out of 95. Historic passive DNS analysis shows no recorded association with legitimate antivirus infrastructure, and the domain has accrued zero entries on blocklists surveyed by ThreatFox, OpenPhish, and PhishTank. This domain is weaponized against users searching for PC protection tools; it lures victims with deceptive advertisements or SEO poisoning, then prompts an “update.exe” download that captures Windows login tokens and browser passwords before terminating with a spurious activation error. Because the installer exhibits no signature-level detection, endpoint reliance on traditional AV is insufficient. Users who have downloaded or executed any file from this domain should revoke saved passwords in a clean environment, re-image affected systems if enterprise-managed, and submit samples to VirusTotal for retroactive detection. Block the IP range 97.74.94.0/24 at perimeter and DNS gateways, and flag the domain as a credential theft host in corporate blocklists.