first-illuminated[.]bond

This domain, first-illuminated.bond, is identified as a generic phishing infrastructure leveraging Node.js and Express frameworks. Analysis indicates no direct brand impersonation or known drainer kit signatures, suggesting a broader credential harvesting campaign rather than targeted financial theft. The domain's technical implementation includes HTTP/3 protocol support, which may be used to evade traditional network-based detection mechanisms. Infrastructure analysis reveals the domain was registered on April 28, 2026, through NameSilo, LLC, and resolves to IP address 172.67.169.44, a Cloudflare-hosted endpoint. VirusTotal detection shows 10 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The page title 'Error' suggests either a placeholder state or deliberate obfuscation of the phishing interface. No Google Safe Browsing (GSB) entries were recorded at the time of analysis. The domain has been taken offline, reducing immediate exposure risk. However, historical resolution data and registration details remain valid indicators for retrospective threat hunting. Organizations should monitor for connections to 172.67.169.44 and the unique seed da95af in network logs, particularly those involving Node.js/Express traffic patterns. Cloudflare's involvement indicates potential for rapid redeployment under new domains, necessitating continuous monitoring of newly registered NameSilo domains with similar technical characteristics.