# PhishDestroy threat dossier — qualitylive.us ================================================================ Fetched: 2026-08-01 08:40:44 UTC Canonical: https://phishdestroy.io/domain/qualitylive.us/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 198.54.119.207 (US, Los Angeles) ASN: AS22612 Namecheap, Inc. Hosting org: Namecheap, Inc. Registered: 2026-06-02 Page title: Account Suspended HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Sectigo Limited / Sectigo Public Server Authentication CA DV R36 Expires: 2026-12-14 Status: INVALID chain Fingerprint: 72a883be73dca7d9f97ba2f06805f10d42e9b2268a9403d48780fb31e27a1775 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-02 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-02 13:30:10 UTC (by PhishDestroy tracker) First reported: 2026-06-15 00:27:29 UTC (abuse notice filed) Last verified: 2026-08-01 08:20:43 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 17:51:29 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] qualitylive.us — Credential Phishing Domain Report Analysis of the domain qualitylive.us indicates active credential phishing infrastructure targeting users as of July 12, 2026. The domain was registered on June 2, 2026, and remains operational despite detection by multiple security mechanisms. Infrastructure analysis reveals the domain resolves to IP address 198.54.119.207, hosted on a provider known for low-cost hosting services. The SSL certificate, issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R3, suggests automated issuance common in phishing campaigns, though it does not inherently confirm malicious intent. Security vendors have flagged qualitylive.us with 5 detections out of 95 on a widely used threat intelligence platform, indicating moderate consensus on its malicious nature. The domain appears on three distinct security blocklists, reinforcing its classification as high-risk. Current HTTP responses return a 403 Forbidden status, which may indicate either a temporary defensive measure by the threat actor or an automated blocking response from the hosting environment. This behavior is consistent with phishing pages that rotate access controls to evade detection while maintaining persistence. Defenders should treat qualitylive.us as an active threat. The domain’s registration recency, combined with its presence on multiple blocklists and detection by security vendors, justifies immediate blocking at the DNS and network layers. Organizations are advised to monitor for connections to 198.54.119.207 and inspect logs for any prior interactions with the domain. Given the 403 response, it remains uncertain whether the phishing page is temporarily disabled or selectively served, so continued vigilance is recommended. No specific brand impersonation or phishing kit details are currently available, but the domain’s structure and hosting pattern align with credential harvesting campaigns. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 72a883be73dca7d9f97ba2f06805f10d42e9b2268a9403d48780fb31e27a1775 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/qualitylive.us/ JSON API: https://api.destroy.tools/v1/check?domain=qualitylive.us Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,281 domains (91,207 alive under monitoring, 27,324 confirmed neutralized). Site: https://phishdestroy.io