lalvice[.]live

This domain, lalvice.live, is actively engaged in credential harvesting phishing operations specifically targeting users of the Messenger platform. Analysis indicates the site mimics legitimate Messenger login interfaces to deceive visitors into submitting their account credentials, which are then captured by threat actors for unauthorized access, account takeovers, or further malicious activities such as financial fraud or identity theft. The infrastructure is designed to exploit trust in the Messenger brand, leveraging social engineering tactics to maximize victim engagement. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. VirusTotal reports that 13 out of 95 security vendors have flagged lalvice.live as malicious, while it also appears on one security blocklist. The domain resolves to the IP address 172.67.218.213, which has been linked to other phishing campaigns in recent threat intelligence pulses. Additionally, the domain has been identified in one AlienVault OTX threat intelligence report, further corroborating its malicious nature. Users who have visited lalvice.live or entered credentials on the site should take immediate action to mitigate potential risks. First, change passwords for any accounts that may have been exposed, prioritizing Messenger and any accounts where the same credentials were reused. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor accounts for suspicious activity, such as unrecognized logins or messages sent without consent. If financial or personally identifiable information was submitted, consider placing a fraud alert on credit reports and reviewing financial statements for unauthorized transactions. Finally, report the domain to relevant security teams or platforms to aid in broader threat mitigation efforts.