www-firstharlzon[.]top

This domain, www-firstharlzon.top, has been identified as a credential theft phishing site designed to harvest user login credentials. Analysis of the page title, 'Log In,' and the domain structure suggests an attempt to impersonate a legitimate authentication portal, likely targeting unsuspecting users through deceptive login prompts. No direct evidence of a crypto drainer kit or brand-specific impersonation (e.g., financial institutions or e-commerce) was observed, but the generic login interface aligns with broad credential harvesting tactics. Technical indicators confirm the domain's malicious nature. The domain resolves to the IP address 144.31.244.50, hosted under AS213877 (U1 DIGITAL SERVICES LTD) in Germany. It was registered on December 16, 2025, through the registrar 耐思尼克国际集团有限公司, a provider frequently associated with high-risk domains. VirusTotal detection metrics show 20 out of 95 security vendors flagging the domain as malicious. The domain appears on four security blocklists, including entries in PhishDestroy, Polkadot, Enkrypt, and Codeesura. The SSL certificate, classified as R13, further indicates low trust, as this type of certificate is often used in short-lived phishing campaigns to mimic legitimacy without proper validation. As of the latest assessment, www-firstharlzon.top has been taken offline, reducing immediate exposure risk. However, the infrastructure analysis reveals patterns consistent with disposable phishing domains, including the use of a recently registered domain and a hosting provider known for lax abuse enforcement. Organizations and individuals are advised to monitor for similar domains registered through the same registrar or resolving to the identified IP range. Users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Proactive blocking of the domain and its associated IP at the network level is recommended to prevent residual access attempts.