user[.]crescent-trustee[.]icu

This domain, user.crescent-trustee.icu, operates as a fraudulent cryptocurrency platform impersonating Crescent Trustee GmbH, a legitimate financial entity. The site is designed to deceive users into submitting wallet credentials or transferring digital assets under false pretenses, likely functioning as a crypto drainer. The page title explicitly mimics the branding of Crescent Trustee GmbH, a tactic commonly employed to lend credibility to phishing operations targeting cryptocurrency holders and investors seeking trustee services. Analysis of the domain’s infrastructure reveals multiple high-confidence indicators of malicious activity. The domain was registered on January 26, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and fraudulent domains. It is currently flagged by 5 out of 95 security vendors on VirusTotal, including detections for phishing and fraudulent financial activity. Additionally, the domain appears on three independent security blocklists and resolves to the IP address 188.114.96.3, which has been linked to other confirmed phishing campaigns. The domain’s trust score is 0/100, further corroborating its malicious classification. Users who have visited user.crescent-trustee.icu or interacted with its content should take immediate remedial action. Disconnect any wallets or devices that may have been exposed to the site, revoke any active smart contract approvals, and monitor connected accounts for unauthorized transactions. If credentials or private keys were entered, assume they are compromised and transfer assets to a new, secure wallet. Report the domain to relevant financial and cybersecurity authorities to assist in broader mitigation efforts. Given the domain’s elevated risk level and confirmed offline status, continued vigilance is advised for any related phishing attempts.