octantupdate[.]live

Analysis of octantupdate.live shows a high‑risk credential‑phishing operation that remains active as of July 24, 2026. The domain was registered on February 22, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 172.67.130.30, located in the United States under ASN 13335. The site presents a generic page title “Just a moment…”, returns an HTTP 403 status code, and is served behind Cloudflare with Browser Insights and HTTP/3 enabled. The TLS certificate is issued by Let’s Encrypt (E8), confirming the use of a free, automated certificate.

Infrastructure evidence indicates the domain is using Cloudflare’s default nameservers (neil.ns.cloudflare.com and rosaly​n.ns.cloudflare.com). Reputation data is unfavorable: three of ninety‑five VirusTotal scanners flagged the domain, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on four external blocklists. It is also listed by PhishDestroy, MetaMask, ScamSniffer, and SEAL as a blocked credential‑phishing source. The threat classification is explicitly identified as credential phishing.

While the page content has not been publicly disclosed, the combination of a restrictive HTTP response, Cloudflare shielding, and low trust scores suggests a deliberate attempt to host malicious login collection pages. Defenders should block the domain at perimeter firewalls, update DNS filtering policies to include the four known blocklists, and monitor outbound connections to the IP 172.67.130.30 for suspicious credential exfiltration. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution of the payload or additional detections.