access-web-auth-097[.]live

This domain, access-web-auth-097.live, is identified as a credential harvesting phishing site targeting users through deceptive authentication prompts. Analysis indicates no direct brand impersonation or crypto drainer kit association, but the site employs generic phishing tactics to capture login credentials. The page title 'Please Wait' suggests an attempt to mimic legitimate authentication flows, likely to deceive users into entering sensitive information under false pretenses. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, an uncommon registrar for legitimate services. It resolves to the IP address 192.109.200.176, hosted on an Apache HTTP Server running Ubuntu. VirusTotal reports 6 out of 95 security vendors flagging this domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms, including MetaMask and SEAL. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious nature. As of the latest assessment, access-web-auth-097.live has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat vector, as the domain could be reactivated or repurposed. Users who may have interacted with this domain are advised to reset credentials for any accounts accessed during the exposure window. Network administrators should ensure blocklist updates are applied to prevent future access attempts. Continuous monitoring of related IPs and registrar activity is recommended to mitigate residual risk from this campaign.