nado-hqupdate[.]live

This domain, nado-hqupdate.live, is identified as a credential-phishing infrastructure designed to harvest user login credentials through fake corporate or administrative login portals. Analysis indicates the domain is currently offline, though it previously posed an elevated risk to targeted organizations. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on April 04, 2026. It resolved to the IP address 104.21.7.250, hosted on infrastructure associated with Cloudflare, Inc. in Canada. The domain was flagged by 9 of 95 security vendors on VirusTotal, and appeared on at least one security blocklist. It was specifically blocked by PhishDestroy. The SSL certificate was issued by Let's Encrypt (serial number E7), a common tactic used to lend false legitimacy to phishing sites. The domain is currently offline, reducing immediate risk to users. However, organizations should remain vigilant, as phishing infrastructure often resurfaces under similar naming conventions or reused registrant details. Security teams are advised to monitor for related domains registered through the same registrar, particularly those using Cloudflare IP ranges or Let's Encrypt certificates. Network-level blocking of the IP 104.21.7.250 and the domain nado-hqupdate.live is recommended as a precautionary measure. Users should be educated on recognizing credential-phishing attempts, particularly those impersonating internal login portals.