cream-finance-cream[.]com

Analysis of the domain cream-finance-cream.com indicates a high-risk phishing infrastructure targeting users of the Cream Finance decentralized finance platform. The domain was registered on October 10, 2025, through NiceNIC International Group Co., Limited, and remains active as of July 12, 2026. Infrastructure reveals the use of Cloudflare services and HTTP/3 protocol, with resolution to IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains. The domain appears on two security blocklists (PhishDestroy and BLP-Malware) and is referenced in 23 threat intelligence pulses on AlienVault OTX, suggesting broader detection within the security community. The page title 'Index of /' typically indicates an exposed directory listing, which may be leveraged to host malicious payloads or phishing kits, though the exact content remains unanalyzed. No specific phishing kit or brand impersonation details are confirmed beyond the domain name's resemblance to Cream Finance. Defenders should treat this domain as actively malicious, particularly in environments involving cryptocurrency or decentralized finance. Blocking at the DNS or network level is recommended, alongside monitoring for connections to the associated IP address. Further investigation into hosted content is advised to determine the precise attack vector, though no direct evidence of credential harvesting, token theft, or smart contract exploitation has been confirmed at this stage.