check-secure[.]live

PhishDestroy analysts investigated check-secure.live, a domain engaged in credential phishing attacks. The domain is currently offline, but it was actively used to harvest login credentials by mimicking legitimate secure login pages.

Technical analysis reveals that check-secure.live was flagged by 5 out of 95 VirusTotal security vendors, indicating malicious activity. The domain was registered on May 24, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, and its SSL certificate was issued by Let's Encrypt (E7). It resolved to IP address 188.114.97.3 and appeared on three security blocklists. Despite a low trust score from security vendors, the domain's specific phishing nature and use of HTTPS suggest a sophisticated attempt to evade detection.

Since the domain is now offline, the immediate threat is mitigated. However, users who may have interacted with check-secure.live should change their passwords and enable multi-factor authentication on any accounts for which credentials might have been compromised. PhishDestroy recommends monitoring for unusual account activity and reporting any suspicious emails or links to security teams. For future protection, always verify the legitimacy of login pages before entering credentials, especially when prompted by unsolicited messages.