tracking-service[.]live

This domain, tracking-service.live, is flagged as a delivery scam targeting users through a fraudulent Western Union payment tracking interface. The site presents itself as 'Western Money Tracker | Global Payment Logistics,' designed to harvest login credentials, payment details, and personal information under the guise of legitimate financial transaction monitoring. Analysis indicates the absence of any legitimate Western Union affiliation, with infrastructure likely controlled by threat actors specializing in financial fraud. Infrastructure analysis reveals the domain was registered on May 17, 2026, through Dynadot Inc, an uncommon future date suggesting possible registry manipulation or typo-squatting tactics. It resolves to IP address 163.61.188.9, hosted on AS153568 (NEW DHAKA HARDWARE), a network with a history of abuse. The domain is currently flagged by 2 out of 95 security vendors on VirusTotal and appears on one security blocklist. SSL certification is provided by Let's Encrypt (YR1), a common tactic to lend superficial legitimacy to phishing sites. No Google Safe Browsing detections are recorded at this time, but the domain remains active and unremediated. Current status confirms tracking-service.live is still operational, posing an ongoing high-risk threat to users encountering fake delivery notifications or payment tracking prompts. Recommended response actions include immediate blacklisting of the domain and IP across enterprise security controls, revocation of the SSL certificate, and reporting to registrar abuse contacts for takedown. Users should verify payment tracking URLs directly through official Western Union channels and avoid entering credentials on unsolicited tracking portals. The domain's future-dated registration and lack of widespread detection suggest potential for prolonged abuse if left unaddressed.