reg-falconfi[.]live

This domain, reg-falconfi.live, is identified as an active credential theft operation targeting cryptocurrency users. Analysis indicates the site employs deceptive login interfaces mimicking legitimate wallet services to harvest private keys, seed phrases, or authentication credentials. No explicit brand impersonation or drainer kit signatures have been confirmed, but the infrastructure aligns with known credential harvesting campaigns observed in recent threat intelligence reports. Infrastructure analysis reveals the domain was registered on June 23, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.96.3, which has been linked to other phishing infrastructure in prior incidents. Detection metrics show 4 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing (GSB) has not yet listed it as of this analysis. The domain appears in one threat intelligence pulse on AlienVault OTX, suggesting limited but confirmed malicious activity. The domain remains active and poses a high risk to users who may encounter it through phishing links distributed via email, social media, or compromised advertisements. No takedown actions have been observed, and the hosting provider has not responded to abuse reports at the time of writing. Users are advised to block the domain at the network level and verify all cryptocurrency-related interactions through official channels. Wallet holders should treat any unexpected login prompts from this domain as fraudulent and avoid entering sensitive information.