vayla[.]live

PhishDestroy identifies vayla.live as a newly registered phishing domain linked to a generic job scam drainer kit under active investigation. The domain mimics legitimate employment platforms to harvest credentials and financial data from job seekers. No specific brand is being impersonated at this time, but the kit structure suggests targeting of professional and financial information.

This domain was flagged with a VirusTotal detection score of 0 out of 95 engines as of the latest scan. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 172.67.185.86. The domain was created on April 27, 2026, and holds a valid SSL certificate issued by Let's Encrypt, increasing its credibility to potential victims. It has not yet been blocked by Google Safe Browsing (GSB) and remains absent from major threat intelligence blocklists at this time.

As of this report, vayla.live remains ACTIVE with a status of under investigation. No public takedown actions have been recorded. The domain poses an emerging risk with low initial detection but high potential for escalation as the campaign matures. PhishDestroy recommends immediate domain blocking and user awareness campaigns targeting job seekers. Remaining risk is classified as medium with potential to rise to high depending on campaign scale and victim engagement.