sorer[.]live

This domain, sorer.live, is identified as a high-risk credential theft operation targeting customers of U.S. Bank. Analysis indicates the site masquerades as an official U.S. Bank Support live chat portal, a tactic designed to harvest login credentials, personal identification details, and financial information from unsuspecting victims. The specificity of the impersonation—including the use of the bank’s branding, page title, and simulated support interface—increases the likelihood of successful deception, particularly among users seeking immediate assistance. Infrastructure analysis reveals multiple technical indicators corroborating malicious intent. The domain was registered on June 17, 2024, through Global Domain Group LLC, a registrar frequently associated with suspicious registrations. It resolves to the IP address 188.114.96.3, which has been linked to other phishing infrastructure in recent months. Detection metrics further substantiate the threat: the domain is flagged by 9 out of 95 security vendors on VirusTotal and appears on at least one security blocklist, specifically PhishDestroy. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying malicious activity. Notably, the domain remains active as of the latest assessment, indicating ongoing operational status. Mitigation of this credential theft campaign requires a multi-layered approach. Network-level protections should include immediate blocking of the domain sorer.live and its resolving IP address 188.114.96.3 across all security gateways. Endpoint security solutions should be configured to detect and prevent access to the domain, particularly in environments where financial transactions or sensitive data handling occur. User awareness training is critical, with emphasis on verifying the authenticity of support portals through official channels—such as the bank’s verified website or customer service hotline—before entering credentials. Financial institutions should monitor for anomalous login attempts originating from this domain and implement multi-factor authentication (MFA) requirements to reduce the impact of credential compromise. Proactive takedown requests should be submitted to the registrar and hosting providers to disrupt the campaign’s infrastructure.