mysoldrop[.]live

This domain, mysoldrop.live, is identified as a credential harvesting phishing site designed to mimic legitimate authentication portals. The page title 'Online Active Connect' suggests an attempt to deceive users into entering sensitive login credentials, which are then captured by threat actors for unauthorized access or financial fraud. The domain specifically targets individuals or organizations by presenting a seemingly official interface, increasing the likelihood of successful exploitation through social engineering tactics.

Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. Infrastructure analysis reveals it resolves to the IP address 104.21.60.156, hosted on Cloudflare's network (AS13335). The domain is flagged by 17 out of 95 security vendors on VirusTotal, and appears on 2 distinct security blocklists. Additionally, the SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing sites. These technical indicators, combined with its offline status, suggest the domain was part of a short-lived but targeted phishing campaign.

Users who visited mysoldrop.live or entered credentials on the site should immediately take corrective actions. First, reset passwords for any accounts accessed or entered on the domain, prioritizing those with administrative or financial privileges. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor linked accounts for suspicious activity, such as unauthorized transactions or login attempts from unfamiliar locations. If corporate credentials were exposed, report the incident to internal security teams for further investigation and containment. Finally, ensure endpoint security tools are updated to detect and block similar phishing domains in the future.