aztecupdate[.]live

Analysis of aztecupdate.live, which was taken offline as of the report date, indicates that the domain was used for credential phishing. The domain was registered on 22 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335) with the public address 172.67.202.215 located in the United States. DNS resolution points to two Cloudflare name servers, marge.ns.cloudflare.com and kianchau.ns.cloudflare.com, confirming the use of Cloudflare's edge service. The site employed HTTPS with a Let’s Encrypt certificate (E8) and advertised HSTS and HTTP/3, typical of legitimate sites, which can aid evasion of naïve inspection.

An HTTP request returned a 403 status code and the page title reported “Just a moment…”, a response commonly employed by Cloudflare challenge pages. The domain appears on one security blocklist and was actively blocked by PhishDestroy. VirusTotal scans recorded three detections out of ninety‑five submitted engines, providing additional independent confirmation of malicious intent. No further content was captured before the takedown, so the specific credential‑harvesting page or targeted brand cannot be confirmed.

Nonetheless, the combination of recent registration, Cloudflare‑hosted infrastructure, HTTPS with a public certificate, and the observed blocklist entries strongly suggests a short‑lived phishing campaign. Defenders should continue to block the domain at perimeter and DNS filters, monitor for any re‑registration or similar look‑alike domains, and consider sharing the indicator set (domain, IP, nameservers, certificate fingerprint) with threat‑intel platforms. Because the site is offline, active investigation of the payload or harvested credentials is limited; however, the infrastructure details provided can be used to correlate with other observed malicious activity.