reg-falconfi[.]com

This domain is an active phishing site designed to steal cryptocurrency wallet credentials and private keys from users attempting to access FalconFi services. The site mimics legitimate wallet interfaces, tricking victims into entering sensitive information that attackers then use to drain digital assets from connected accounts. Analysis indicates the domain specifically targets users of decentralized finance platforms, with a focus on immediate fund exfiltration upon credential capture. Infrastructure analysis reveals the domain was registered on June 23, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an uncommon registrar for legitimate financial services. The site currently resolves to IP address 104.21.51.116 and uses a Google Trust Services SSL certificate to appear legitimate. Security vendors on VirusTotal flag this domain at a 4/95 detection rate, while independent blocklists maintained by two security organizations have added it to their denylists. The domain remains active despite being blocked by multiple wallet security extensions. Users who visited reg-falconi.com should immediately revoke any wallet permissions associated with the site and transfer assets to a new wallet with fresh seed phrases. Monitor all connected accounts for unauthorized transactions, as attackers typically drain funds within minutes of credential capture. Report the incident to relevant platform security teams and consider filing reports with local cybercrime authorities. Never reuse passwords or seed phrases across services, as compromised credentials may be tested against other platforms. Future access attempts should be verified through official channels only, avoiding any links or redirects from untrusted sources.