member-meets-live[.]madxapp[.]com

PhishDestroy identifies member-meets-live.madxapp.com as a live credential theft and crypto drainer scam actively impersonating the 'Meets Live' platform, a legitimate video-conferencing and social-streaming brand. The domain leverages a homograph-style typo to deceive users into surrendering login credentials or cryptocurrency wallet seeds, with the threat actor harvesting data for immediate draining. WHOIS data confirms registration through GoDaddy.com, LLC on November 25, 2019, suggesting possible domain squatting or dormant re-registration rather than fresh creation.

This domain resolves to IP 172.67.168.186 and is secured with a Google Trust Services SSL certificate, which may lull users into a false sense of security. VirusTotal currently reports 0/95 detections, indicating the site remains undetected by antivirus engines as of seed f5046c. It is not yet flagged by Google Safe Browsing (GSB status unknown) and has no blocklist entries recorded, highlighting a significant window of opportunity for threat actors to operate unchecked. The recent surge in impersonation-themed drainer campaigns targeting video-platform brands supports the classification of this domain as an active, evolving threat.

The domain status remains active and under investigation. Users are advised to block both the domain and IP address at network perimeter and DNS level. Security teams should monitor for related wallet addresses and credential reuse across breached datasets. Remaining risk is classified as HIGH due to active operation, absence of detections, and plausible impersonation of a high-traffic brand. Immediate defensive action—network blocking and user awareness alerts—is strongly recommended to mitigate potential credential and cryptocurrency loss.