onlineinvitelivevideocall[.]com

PhishDestroy identifies onlineinvitelivevideocall.com as an active crypto drainer domain operating under the guise of a live video call invitation service. The domain mimics legitimate video conferencing platforms to trick users into connecting cryptocurrency wallets under the pretense of a secure or exclusive call invite. While no specific drainer kit fingerprint has been publicly documented, the site’s behavior aligns with known crypto-draining campaigns that exfiltrate wallet credentials or initiate unauthorized token transfers. Threat actors leverage urgency (e.g., “limited-time video room”) and social engineering to prompt wallet connections, a common tactic in crypto phishing campaigns targeting retail and institutional users.

This domain was flagged with the following technical indicators: VirusTotal currently shows 8/95 detections, indicating no antivirus engines have flagged its payloads or infrastructure. It resolves to IP 188.114.96.3 and uses a Google Trust Services SSL certificate, likely to appear legitimate. Registered through TuringSign Inc. d/b/a Cosmotown on January 06, 2026, the domain is newly active and remains unlisted on major blocklists such as Google Safe Browsing (GSB) as of this report. Its recent creation date and lack of detections suggest it may be in early deployment or operating under low visibility to avoid detection.

The domain remains active and under investigation, with no confirmed takedown or blocklist inclusion at this time. Users are advised to avoid visiting the site or interacting with any wallet connection prompts. Security teams should monitor the IP (188.114.96.3) and domain for associated malicious artifacts. Remaining risk is high due to the absence of detection coverage and the domain’s potential to evolve into a more robust phishing or malware distribution node. Immediate user caution and network-level blocking are recommended to mitigate exposure.