crestfinances[.]com

The domain crestfinances.com is a confirmed phishing site engaged in brand impersonation targeting Revolut, a financial services provider. It poses an elevated risk by mimicking Revolut's online banking interface to harvest user credentials, though no crypto drainer kit was detected. As of the latest verification, crestfinances.com has been taken offline.

Technical indicators confirm its malicious nature: 1 of 95 VirusTotal security vendors flagged the domain, while Google Safe Browsing has not yet marked it. The domain appears on one security blocklist (PhishDestroy) and was registered through Cosmotown, Inc. on November 07, 2024. It resolved to the IP address 104.21.94.176, hosted on Cloudflare's network (AS13335) in the US, and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was '- Online Banking & Payment Processing', and technologies detected include Bootstrap, jQuery, and Cloudflare. Gridinsoft and Scamadviser assigned trust scores of 0/100 and 1/100, respectively, further indicating its fraudulent intent.

Users who interacted with crestfinances.com should immediately change their Revolut account passwords and enable two-factor authentication (2FA) if not already active. Monitor bank statements and credit reports for unauthorized transactions, and report the incident to Revolut's official fraud team. Additionally, victims may file complaints with local cybercrime units or platforms like the FBI's IC3 (Internet Crime Complaint Center) or the FTC. To prevent future exposure, verify domain authenticity before entering credentials and use browser-based phishing filters or security extensions.