crestayieldor[.]live

This domain, crestayieldor.live, is flagged as a generic phishing site targeting users through a fraudulent AI-assisted trading platform facade. Analysis indicates the page title "Cresta Yieldor | Official Platform for AI Assisted Trading" is designed to mimic legitimate fintech services, likely to harvest login credentials or financial information. No specific drainer kit signatures were identified, but the infrastructure aligns with common phishing toolkits leveraging cloud-based obfuscation. Infrastructure analysis reveals the domain was registered on May 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, with an SSL certificate issued by Let's Encrypt. It resolves to the IP address 188.114.96.3 and employs technologies including Unpkg, jsDelivr, jQuery, and Cloudflare services. The domain appears on one security blocklist and is flagged by 7 out of 95 security vendors on VirusTotal. Google Safe Browsing status is not explicitly confirmed, but the domain is actively blocked by at least one threat intelligence feed. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. However, residual risk remains as threat actors may re-deploy the phishing kit under a new domain or IP. Users who interacted with the site should immediately reset credentials for any financial or trading platforms, monitor accounts for unauthorized activity, and verify SSL certificates on legitimate services to avoid further compromise. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.