eligibilitychecker[.]live

Analysis of eligibilitychecker.live shows the domain was registered on July 10, 2025 through NiceNIC International Group Co., Limited and subsequently resolved to the IP address 216.150.1.129, which belongs to AS16509 Amazon.com, Inc. and is geolocated in the United States. The site employed a Let’s Encrypt R13 TLS certificate and advertised the use of Vercel hosting together with HTTP Strict Transport Security, indicating a modern deployment stack. A scan on VirusTotal returned five positive detections out of ninety‑five participating security vendors, confirming that at least a minority of AV engines flag the domain as malicious.

The domain appears on a single public blocklist and is actively blocked by PhishDestroy, reinforcing the assessment that it is being used for phishing‑related activity. The only observed HTTP response was a 404 status with the page title "404: NOT_FOUND," suggesting that the content was either removed or never served. Current monitoring indicates the domain has been taken offline, but the infrastructure artifacts—IP address, hosting provider, SSL certificate, and blocklist entries—remain observable.

Uncertainty remains regarding the exact phishing payload or targeted brand, as no page content was captured and no additional victim reports have been linked. Defenders should continue to block the domain at perimeter filters, add the IP to threat‑intel feeds, and monitor DNS queries for related Vercel‑hosted subdomains. Ongoing vigilance is advised because the underlying hosting environment could be reused for future campaigns, and the elevated risk rating reflects the combination of malicious detections, active blocklisting, and the presence of security‑hardening technologies that may be leveraged to evade casual analysis.