53livesupport[.]vip

Analysis indicates that the domain 53livesupport.vip is actively involved in a high-risk phishing campaign targeting cryptocurrency users. Registered on February 19, 2026, through Dynadot LLC, the domain resolves to the IP address 91.92.241.15 and utilizes HTTP/3 for communication. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious infrastructure. As of July 12, 2026, the domain is flagged by 15 of 95 security vendors on VirusTotal and appears on four distinct security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. Additionally, the domain is referenced in 24 threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. The page title, 'Index of /', suggests the domain may be hosting an open directory or misconfigured server, which is often indicative of hastily deployed phishing infrastructure. Gridinsoft assigns the domain a trust score of 0/100, reinforcing its high-risk status. While the exact nature of the phishing content remains unconfirmed due to the lack of detailed page analysis, the combination of cryptocurrency-related blocklists (e.g., MetaMask) and the domain name itself implies a focus on impersonating support services for cryptocurrency platforms. Defenders should treat this domain as actively malicious and prioritize blocking resolutions to 91.92.241.15, as well as monitoring for related subdomains or newly registered lookalike domains under the same registrar. Given the domain's presence on multiple blocklists and its association with known phishing indicators, organizations are advised to update their threat intelligence feeds accordingly and investigate any internal traffic to this domain for potential compromise.