linelive[.]live

PhishDestroy identifies linelive.live as an active crypto drainer posing as a generic streaming platform to harvest user credentials. This domain was flagged by only one of 95 security vendors on VirusTotal, highlighting its ability to evade detection while targeting unsuspecting victims. Registered via Name.com, Inc. on March 21, 2026, the infrastructure leverages a Let's Encrypt SSL certificate, adding a veneer of legitimacy to its malicious operations. Indicators reveal linelive.live resolves to IP 188.114.96.3, a known malicious endpoint associated with low-profile credential theft campaigns. Its recent creation date and minimal blocklist presence demonstrate attackers' reliance on fresh domains to bypass traditional defenses. The use of Let's Encrypt certificates further complicates detection by mimicking legitimate service providers. Users who visited linelive.live should immediately revoke any shared credentials, enable multi-factor authentication on all accounts, and scan their devices for malware. Security teams should block the domain at the network perimeter and monitor for unauthorized access attempts. Treat any interaction with this site as a potential compromise.