verify-liwell[.]site

Analysis identifies verify-liwell.site as an active credential_phishing domain presenting the page title "Liwell — Management Control System." The observed content indicates an attempt to impersonate a legitimate management or administrative platform in order to collect user credentials. No evidence of a drainer kit was provided in the available intelligence. Based on the reported classification, the domain is assessed as a high-risk credential harvesting operation designed to obtain account access information from targeted users.

Technical indicators support the phishing assessment. The domain is currently reported as active and appears on 3 independent security blocklists. Detection telemetry shows a VirusTotal score of 7/95 security vendors flagging the domain. Registration records indicate the domain was created on May 30, 2026 and registered through Name.com, Inc. Infrastructure analysis shows resolution to IP address 185.158.133.1, with hosting geolocated to PL and associated with AS13335 Cloudflare, Inc. The domain reportedly lacks an SSL certificate, increasing operational risk and reducing trustworthiness. Intelligence sources further indicate that the domain has been blocked by multiple security providers, reinforcing the assessment that the infrastructure is associated with malicious credential collection activity.

The domain remains active at the time of analysis, creating an ongoing exposure risk for users who encounter links directing traffic to the site. Recommended response actions include immediate blocking at network, DNS, email, and endpoint security layers; monitoring for related indicators of compromise; and reviewing authentication logs for any credentials that may have been submitted through the phishing interface. Organizations should notify potentially affected users, enforce password resets where exposure is suspected, and review account activity for unauthorized access attempts. Given the active status, absence of SSL protection, presence on 3 blocklists, and 7/95 vendor detections, the residual risk remains high until the domain is fully remediated or taken offline.