paliv2[.]com

This domain is flagged as an elevated-risk phishing site specifically designed to harvest cryptocurrency wallet credentials. Analysis indicates the threat type aligns with credential theft targeting users of digital asset management platforms, likely through fake login portals or wallet connection prompts. The page title '编组 21' suggests localized targeting or obfuscation techniques to evade detection. Infrastructure analysis reveals the domain was registered on April 15, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with newly created malicious domains. It resolves to IP address 104.21.72.142, a Cloudflare-protected endpoint utilizing HTTP/3, which may complicate traditional traffic inspection. Security vendor detections on VirusTotal stand at 6/95, while the domain appears on three blocklists and holds a trust score of 0/100. Protective services have already marked it as malicious, and it is currently offline. Mitigation requires immediate action from security teams and end-users. Network-level blocking of the domain and its resolving IP (104.21.72.142) is recommended to prevent accidental access. Cryptocurrency wallet users should verify all connection prompts against official sources and enable multi-factor authentication where available. Security teams should monitor for related domains registered through Gname.com Pte. Ltd. or resolving to the same IP range, as threat actors often reuse infrastructure. Incident responders should treat any prior interaction with this domain as a potential credential compromise and initiate password resets for associated accounts.