live05ms[.]us

Analysis of live05ms.us shows a newly registered domain (created 08 April 2026) that is actively serving content over HTTPS with a Sectigo Limited / Sectigo Public Server Authentication CA DV R36 certificate. The site returns HTTP 200 responses and is hosted on a Namecheap‑owned IP address (68.65.122.92) located in the United States. Infrastructure reputation is poor: Gridinsoft assigns a trust score of 0 / 100, the domain appears on three security blocklists, and it is listed in an AlienVault OTX pulse. VirusTotal scans report 18 of 94 security vendors flagging the domain as malicious. Current blocklist coverage includes PhishDestroy, MetaMask, and SEAL. While the exact phishing payload has not been publicly disclosed, the combination of a fresh registration, valid SSL, high‑risk rating, and multiple vendor detections indicates a high‑confidence generic phishing operation. Uncertainty remains around the specific credential‑stealing tactics employed and any victim targeting. Defenders should immediately block live05ms.us at network and DNS layers, monitor outbound traffic to the associated IP, and consider adding the domain to internal blacklists. Ongoing observation of related indicators, such as new URLs or hash signatures, is recommended to capture any evolving threat activity.