# PhishDestroy threat dossier — onlivems.us ================================================================ Fetched: 2026-07-31 05:49:35 UTC Canonical: https://phishdestroy.io/domain/onlivems.us/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 17/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, AlphaSOC, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, Sophos, VIPRE URLQuery: -1 detections AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 198.54.119.191 (US, Dallas) ASN: AS22612 Namecheap, Inc. Hosting org: Namecheap, Inc. Registered: 2026-04-24 Page title: Namecheap Parking Page HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Sectigo Limited / Sectigo Public Server Authentication CA DV R36 Expires: 2026-11-04 Status: INVALID chain Fingerprint: 3f79008a6a17311487cd6a936dff413fdad9e749c8de558ac0937cda010c50c7 Subject Alternative Names (related infrastructure — often same operator): - www.onlivems.us ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-24 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-24 21:30:07 UTC (by PhishDestroy tracker) First reported: 2026-06-15 00:27:29 UTC (abuse notice filed) Last verified: 2026-07-31 04:20:53 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 18:03:27 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] onlivems.us Generic Phishing Domain Active This domain onlivems.us was registered on April 24, 2026 and resolves to the IP address 198.54.119.191 hosted by Namecheap, Inc. in the United States. Infrastructure analysis reveals an active HTTP status 200 response paired with a page title of Namecheap Parking Page and an SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36. The domain maintains MX records directed to mx1-hosting.jellyfish.systems at priority 5 along with an additional record at priority 10. These elements establish the basic network footprint observed on the report date of July 12, 2026. Detection data shows a Gridinsoft trust score of 0/100 together with presence on 3 security blocklists. The domain is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal returns 2 detections out of 95 vendors while AlienVault OTX records the domain inside 1 threat intelligence pulse. The classification lists the threat type as generic_phishing at high risk level with current status marked active. These quantitative indicators provide the primary observable evidence of malicious designation. What remains uncertain is the precise campaign infrastructure or downstream actor attribution beyond the listed blocklist entries and the single OTX pulse. The parking page title suggests possible placeholder content rather than a fully developed lure at the time of observation. No additional ASN or geolocation details beyond the US assignment are supplied in the available records. Defenders should incorporate the IP 198.54.119.191 and the domain onlivems.us into existing block policies and watch for newly registered .us names sharing the same name server or certificate patterns. Regular rechecking of the three blocklist memberships and the VirusTotal count is advisable given the confirmed active status. Monitoring mail flows involving the documented MX hosts may also surface related abuse attempts. [Updates since narrative was generated:] - VirusTotal detections: now 17/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 3f79008a6a17311487cd6a936dff413fdad9e749c8de558ac0937cda010c50c7 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/onlivems.us/ JSON API: https://api.destroy.tools/v1/check?domain=onlivems.us Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,189 domains (84,175 alive under monitoring, 27,239 confirmed neutralized). Site: https://phishdestroy.io