crestfundgrove-app[.]com

This domain, crestfundgrove-app.com, operates as a credential theft and financial fraud infrastructure targeting users through a fake AI-assisted trading platform. The site presents itself as "Crest Fundgrove | Official Platform for AI Assisted Trading," luring victims with promises of automated investment returns. Analysis indicates the domain is designed to harvest login credentials, payment details, or deploy malicious scripts to drain cryptocurrency wallets under the guise of legitimate trading services. Infrastructure analysis reveals the domain was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.152.169, hosted on Cloudflare infrastructure in Canada, which is commonly used to obfuscate malicious origins. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while it appears on one security blocklist. The SSL certificate, issued by Let's Encrypt (serial number E7), provides HTTPS encryption but does not validate legitimacy. The domain remains active as of this report, with no takedown actions observed. Users who visited crestfundgrove-app.com should immediately cease all interactions and assume credentials or financial details entered are compromised. Clear browser caches and cookies to remove any stored session data. Run a full antivirus scan to detect potential malware or browser-based threats. If cryptocurrency transactions were initiated, monitor wallet addresses for unauthorized outflows and report incidents to relevant financial authorities. Enable multi-factor authentication on all financial and email accounts as a precautionary measure. Organizations should update security blocklists to include this domain and its associated IP address to prevent further access.