allocation-lienfi[.]app

The domain allocation-lienfi.app is currently active and flagged as a crypto drainer phishing site targeting users of on-chain tax lien markets. This domain impersonates the legitimate LienFi platform, presenting itself as "LienFi — Onchain Tax Lien Markets" to deceive victims into connecting wallets or entering sensitive credentials. Analysis indicates the infrastructure is designed to siphon cryptocurrency assets upon interaction, a tactic consistent with drainer-type phishing operations. Infrastructure analysis reveals the domain was registered on May 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing activity. It resolves to the IP address 188.114.97.3, hosted behind Cloudflare, Inc. in Canada, a common obfuscation technique to mask true origin. The domain is flagged by 1 of 95 security vendors on VirusTotal and appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let’s Encrypt (serial E8), a legitimate but frequently abused provider for malicious domains. Detection rates remain low, suggesting the campaign is either new or employing evasion tactics. Current status indicates the domain remains active and operational as of this report. Users are advised to treat allocation-lienfi.app as hostile infrastructure and avoid all interaction. Wallet providers and security teams should update blocklists to include this domain and its resolving IP. Organizations should monitor for connections to 188.114.97.3 in network logs, particularly from endpoints with crypto wallet software. If credentials or wallet access were provided, immediate revocation of permissions and transfer of assets to a secure wallet is recommended. Vigilance for similar domains using the "lienfi" naming convention is warranted, as threat actors may register additional lookalike domains.