tfh-worldcoin[.]com

This domain, tfh-worldcoin.com, operates as a cryptocurrency phishing site designed to deceive users into disclosing wallet credentials, recovery phrases, or personal authentication details. The site impersonates Worldcoin, a legitimate identity and financial network, by replicating its branding, page layout, and messaging—including the exact page title 'World - The real human network.' Victims who enter sensitive information risk immediate unauthorized access to their digital assets, as well as potential follow-on attacks such as account takeovers or targeted social engineering. Analysis indicates the domain was registered on January 9, 2026, through Dynadot Inc, a known registrar frequently used in phishing infrastructure. It resolves to the IP address 172.66.167.18 and is hosted behind a Google Trust Services SSL certificate, which provides a false sense of legitimacy. At the time of detection, 6 out of 95 security vendors on VirusTotal flagged the domain as malicious. The site appears on three independent security blocklists and is actively blocked by wallet protection and anti-phishing tools. Infrastructure analysis reveals the use of modern web technologies including Node.js, React, Next.js, and Amazon Web Services, suggesting a sophisticated, serverless deployment designed to evade traditional detection methods. If you visited tfh-worldcoin.com, immediately disconnect the device from the network to prevent ongoing data exfiltration. Do not enter any credentials or recovery phrases, even if prompted. If you submitted wallet information, transfer all assets to a new, secure wallet using a different device. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant wallet providers and consider filing a report with local cybercrime authorities. Reset any passwords or recovery phrases used on the site, and scan your device for malware using updated security tools.