tfq06s[.]top

This domain, tfq06s.top, operates as a fraudulent token claim portal designed to harvest cryptocurrency wallet credentials and private keys. Analysis indicates the site mimics legitimate airdrop or token distribution pages, presenting users with fake prompts to connect wallets or input recovery phrases. The infrastructure employs deceptive interfaces resembling trusted decentralized finance platforms, increasing the likelihood of credential compromise for unsuspecting visitors. Infrastructure analysis reveals the domain was registered on March 20, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with recently established phishing domains. The domain resolves to the IP address 188.114.96.3 and is currently flagged by 14 out of 95 security vendors on VirusTotal. It appears on four distinct security blocklists and is explicitly labeled under the SOCIAL_ENGINEERING category by Google Safe Browsing. Additional technical indicators include the use of Vue.js for dynamic content rendering, Cloudflare for hosting and DDoS protection, and HTTP/3 for optimized data transmission, all of which are consistent with modern phishing infrastructure. Users who interacted with tfq06s.top should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet. All credentials entered on the site must be considered compromised and should be changed across all platforms where they may have been reused. Monitoring for unauthorized transactions is strongly advised, and affected individuals should report the incident to relevant blockchain security teams for further mitigation. The domain has since been taken offline, but similar threats may emerge using comparable infrastructure.