quickpromo[.]live

This domain, quickpromo.live, is identified as a cryptocurrency phishing site designed to deceive users into disclosing sensitive information or transferring digital assets. The site mimics legitimate cryptocurrency marketing platforms, using social engineering tactics to exploit victims under the guise of professional services. Given its focus on cryptocurrency, the threat is particularly severe for users involved in digital asset trading or investment, where credentials and wallet access are high-value targets. Analysis indicates the domain was registered on August 30, 2025, through GoDaddy.com, LLC, a common registrar for both legitimate and malicious domains. It resolves to the IP address 188.114.97.3 and is flagged by 4 out of 95 security vendors on VirusTotal, including detection by OISD blocklists. The domain appears in two AlienVault OTX threat intelligence pulses, suggesting active tracking by security researchers. Additional technical indicators include the use of Vue.js, HSTS, and Cloudflare infrastructure, which may be leveraged to evade detection or enhance the site's perceived legitimacy. Users who visited quickpromo.live should immediately revoke any credentials or wallet access shared with the site. Monitor financial accounts and cryptocurrency wallets for unauthorized transactions. If login details were entered, reset passwords for all associated accounts, particularly those linked to cryptocurrency exchanges or wallets. Enable multi-factor authentication where available to mitigate further risk. Report the domain to relevant security teams or threat intelligence platforms to aid in broader detection efforts. Given its current offline status, the domain may reappear under a different name or infrastructure, so vigilance is advised.