cloudupdatenew[.]us

The domain cloudupdatenew.us is currently active and has been classified as a credential phishing infrastructure. DNS resolution points to the IPv4 address 188.114.97.3, which is the sole host observed for this indicator. Multiple commercial and community blocklists have already listed the domain; three distinct blocklists reference it, and three separate protection products – PhishDestroy, MetaMask, and SEAL – have explicitly blocked traffic to the domain. VirusTotal analysis shows that 15 out of 91 scanned security vendors returned a malicious verdict, confirming a consensus of malicious intent among a subset of scanners.

The remaining 76 vendors either returned clean or inconclusive results, which reflects typical variance in detection engines for phishing‑related payloads. No public information is available regarding the domain’s registrar, creation date, SSL certificate details, HTTP response codes, or page title, and the current evidence set does not contain a documented Safe Browsing or OTX entry for this host. Accordingly, the confidence in the malicious classification rests on the observed blocklist presence, the vendor detections, and the IP association. Defenders should prioritize immediate denial of any outbound or inbound traffic to cloudupdatenew.us and to the associated IP address 188.114.97.3.

The domain should be added to DNS and proxy filtering policies, and any credential‑capture alerts that reference this host must be escalated. Continuous monitoring of the IP address for new domain registrations or shifts in hosting infrastructure is advised, as threat actors frequently repurpose compromised servers. Because the threat is labeled as credential phishing and the risk level is high, security teams should also advise users to remain vigilant for unsolicited requests for login credentials that might reference cloud‑related services, even if the visual content of the site is not yet analysed.