duty-free-test-test[.]li

This domain, duty-free-test-test.li, is currently active and operates as a crypto drainer phishing site disguised under a fake reCAPTCHA verification page. The infrastructure targets users by mimicking legitimate security checks to facilitate unauthorized cryptocurrency transactions, a tactic increasingly observed in high-risk phishing campaigns. No specific brand impersonation beyond the reCAPTCHA interface itself has been confirmed, though the design closely replicates standard verification prompts to deceive victims. Analysis indicates the domain is flagged by 4 of 95 security vendors on VirusTotal, with additional detections across three independent blocklists. It resolves to the IP address 37.77.150.237, geolocated in Russia under AS198953 (Proton66 OOO), a hosting provider frequently associated with malicious activity. The SSL certificate is issued by Let's Encrypt (serial number YR2), a common choice for threat actors due to its low-cost and automated issuance process. The registrar for the .li TLD has not been publicly disclosed, but the domain's infrastructure aligns with patterns observed in other high-risk phishing operations. Current trust scores and detection metrics suggest persistent malicious intent, with no signs of takedown or mitigation at this time. As of the latest verification, duty-free-test-test.li remains active and continues to host its deceptive reCAPTCHA-themed phishing page. Users are advised to avoid interaction with the domain and block it at the network level. Organizations should update security controls to include the IP address 37.77.150.237 and the domain in deny lists, while monitoring for related infrastructure under the same ASN or hosting provider. Endpoint protection systems should be configured to detect and prevent access to such domains, particularly those leveraging fake verification prompts to execute financial fraud.