usersurvey[.]live

Analysis indicates that the domain usersurvey.live was active as a brand‑impersonation site targeting the cryptocurrency wallet brand Phantom. The page title observed during the brief live period was “Phantom Survey Incentive Program,” which aligns with the advertised scam type of wallet/seed phishing. The domain resolved to the IP address 192.64.118.37, which is owned by Namecheap, Inc. (AS22612) and is geolocated in the United States. Nameserver records point to dns1.namecheaphosting.com and dns2.namecheaphosting.com, both typical of Namecheap‑hosted domains. No TLS certificate was presented, leaving the site reachable only over HTTP.

The Gridinsoft trust score was recorded as 0 out of 100, reflecting a highly malicious assessment. VirusTotal scans returned five positive detections out of ninety‑five submitted security vendors, indicating that multiple scanners flagged the domain as malicious. Independent blocklist services PhishDestroy and ScamSniffer have listed the domain, and it appears on two additional security blocklists, reinforcing its reputation as a malicious resource. The site has since been taken offline, and current HTTP checks return no content.

Evidence suggests that the infrastructure was modest, relying on shared hosting and generic name‑cheap nameservers, which is common for short‑lived phishing campaigns. Uncertainty remains regarding the full scope of victim interaction, such as the specific phishing page layout or any credential harvesting mechanisms, because the site is no longer reachable for direct inspection. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole feeds with the observed IP and domain, and monitor for any resurgence of the same domain or similar sub‑domains hosted on the same name‑cheap infrastructure.