dpmf-updates[.]live

Analysis of dpmf-updates.live indicates that the domain is actively used for credential phishing. The site was registered on April 11 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare, resolving to IP 104.21.89.146 located in Canada. The TLS certificate is issued by Let’s Encrypt (E7), and HTTP requests return a 403 status code while the page title displayed is “Just a moment…”. The domain appears on a single security blocklist and has been blocked by PhishDestroy, confirming that defensive feeds consider it malicious.

AlienVault OTX lists the domain in one pulse, providing additional community‑based corroboration. VirusTotal scans show that three of ninety‑four antivirus engines flagged the domain, reinforcing the suspicion. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. The combination of a recent creation date, low trust score, presence on blocklists, and detection by multiple vendors suggests a high‑confidence phishing infrastructure despite the limited visible content.

Defenders should add dpmf-updates.live to URL filtering, DNS sink‑hole, and endpoint allow‑list exclusions. Traffic to the associated Cloudflare IP should be logged and, where possible, redirected to a safe‑browse block page. Continuous monitoring of any new detections or intelligence pulses is advised, as the threat actor may evolve the landing page or expand the campaign. Until further forensic analysis of the site’s payload is available, the domain should be treated as malicious and blocked at network perimeters.