kmupdate[.]live

kmupdate.live is a newly registered domain (created 21 Feb 2026) that has been classified as a credential‑phishing site. The domain is registered through NiceNIC International Group Co., Limited and is hosted behind Cloudflare’s network (AS13335) with the IP address 172.67.197.209. DNS resolution uses Cloudflare’s authoritative name servers indie.ns.cloudflare.com and miguel.ns.cloudflare.com. HTTPS is provided by a Google Trust Services certificate issued to WE1, and the site enforces HSTS and HTTP/3, indicating a modern TLS configuration. An HTTP request to the root URL returns a 403 status code, suggesting that direct access is blocked but the underlying service remains reachable.

The page title observed is “Nur einen Moment…”, a generic German phrase meaning “Just a moment…”, which offers no indication of the intended victim brand or lure. Threat intelligence flags the domain on three security blocklists and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. VirusTotal analysis shows that four of ninety‑three security vendors have flagged the domain, providing independent corroboration of its malicious nature.

The combination of a recent registration date, low trust score, blocklist presence, and vendor detections aligns with the high‑risk rating assigned to the domain. Uncertainty remains regarding the specific credential‑collection infrastructure hosted behind the Cloudflare front‑end, as the 403 response prevents content inspection and no additional page content has been disclosed. Defenders should proactively block kmupdate.live at the DNS or proxy layer, add the associated IP address 172.67.197.209 to deny lists, and monitor for any outbound connections to Cloudflare‑served hosts that may be used for credential exfiltration. Continuous re‑scanning with multi‑vendor services is advised to capture any future changes in detection status.