falcowin[.]com

This domain is flagged as an active credential harvesting phishing site with an elevated risk level. Analysis indicates the domain is specifically designed to harvest user login credentials through deceptive login portals, likely mimicking legitimate services to trick victims into submitting sensitive information. Infrastructure analysis reveals falcowin.com was registered on July 3, 2025, through Cloudflare, Inc. and currently resolves to IP address 172.67.144.73. The domain appears on one security blocklist and is detected by 1 out of 95 security vendors on VirusTotal. It employs a Google Trust Services SSL certificate and utilizes Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3 protocols. The page title 'Attention Required! | Cloudflare' suggests an attempt to mimic legitimate Cloudflare security challenges while concealing malicious intent. Mitigation requires immediate blocking of the domain and its associated IP address 172.67.144.73 at network perimeter devices. Security teams should monitor for connections to this IP and domain in proxy logs, particularly focusing on HTTP/3 traffic patterns. End-user education should emphasize verifying domain legitimacy before entering credentials, especially when encountering Cloudflare-branded interstitial pages. Network administrators are advised to inspect SSL certificates for anomalies, as phishing domains frequently use valid certificates from trusted providers to appear legitimate. Log retention policies should be extended to capture historical data for forensic analysis in case of successful credential harvesting incidents.