troveupdate[.]live

This domain, troveupdate.live, is assessed as a high-risk credential phishing operation based on infrastructure analysis and confirmed threat indicators. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain resolves to Cloudflare IP 188.114.96.3 (AS13335) and uses Cloudflare nameservers (fred.ns.cloudflare.com, journey.ns.cloudflare.com). No SSL certificate is present, increasing the likelihood of unencrypted credential transmission.

The page title, 'Trove - Trade the rare, Speculate the future,' suggests an attempt to mimic a trading or investment platform, though the exact content and targeted brand remain unverified due to the domain's offline status. Security vendors flagged this domain on VirusTotal, with 10 of 93 detections as of the last scan, and it appears on four blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The combination of Cloudflare hosting, absence of SSL, and credential phishing classification aligns with known phishing infrastructure patterns.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Given its offline status, further analysis of the phishing kit or backend infrastructure is not currently possible, but historical logs should be reviewed for connections to this IP or domain. No evidence links this domain to a specific brand beyond the suggestive page title, so brand-specific mitigations cannot be recommended without additional context.