docupdate[.]art

The domain docupdate.art was registered with Namecheap on June 30 2026 and is currently active. DNS resolution points to IP 72.251.11.93, which belongs to AS22612 operated by Namecheap in the United States. No TLS certificate is presented, and HTTP requests receive a 302 redirect response. The domain appears on three independent security blocklists and is specifically listed by PhishDestroy, MetaMask, and SEAL as a malicious host. VirusTotal analysis shows a single positive detection out of 91 scanners, indicating at least one vendor has flagged the site. The page title returned by the server is “docupdate.art is registered at Namecheap,” providing no additional context about the hosted content. Infrastructure evidence suggests a typical credential‑phishing setup: a newly registered domain, use of a generic hosting provider, lack of encryption, and redirect behavior commonly employed to forward victims to a credential‑harvesting page. However, without direct content inspection, the exact phishing campaign or targeted brand cannot be confirmed. Defenders should block or sinkhole the domain, monitor DNS queries for the associated IP, and include it in internal threat‑intel feeds. Additional investigation, such as crawling the live site in a sandbox, would be required to determine the specific credential‑phishing tactics and any payloads delivered.