h5[.]xauulive[.]com

PhishDestroy identifies h5.xauulive.com as an active phishing domain impersonating a popular streaming service to harvest user credentials. The domain was flagged under investigation with a risk level of under_investigation, indicating potential but unverified harm to end users.

Analysis reveals this domain resolves to IP 172.67.162.122 and was registered on February 24, 2026, through GMO Internet, Inc., a common registrar associated with malicious domains. Despite utilizing a Let's Encrypt SSL certificate for perceived legitimacy, the domain shows 1 out of 95 detections on VirusTotal, suggesting it has evaded detection by most antivirus engines. Current blocklist status remains unverified, but the recent registration date and lack of detections raise concerns about its rapid deployment in ongoing campaigns.

Users targeted by this domain may experience credential theft, financial fraud, or malware exposure. Mitigation includes blocking the domain and IP at the network perimeter, disabling automatic SSL certificate validation for suspicious domains, and educating employees or users about verifying domain authenticity. Immediate reporting to PhishDestroy or relevant CERT teams is advised to prevent further exploitation. For comprehensive indicators of compromise and remediation steps, access the full threat report.