fbearupdates[.]live

The domain fbearupdates.live was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare IP address 172.67.200.36, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The site presents the page title "Nur einen Moment…" and is protected by an HTTPS certificate issued by Let\'s Encrypt (E7). Technical fingerprints indicate the use of HSTS, Cloudflare Browser Insights, the Cloudflare CDN, and HTTP/3. As of the report date, the domain is offline and returns an HTTP 403 response.

It appears on one security blocklist and is specifically flagged by PhishDestroy. VirusTotal analysis shows that three of ninety‑five security vendors have flagged the domain, classifying it as credential phishing. The evidence aligns with the known scam type of credential phishing, though the specific target brand or the content of the landing page has not been publicly disclosed. No additional malware or command‑and‑control activity is observable from the available data.

Defensive recommendations include adding the domain and its resolved IP address to network deny lists, enforcing URL filtering based on the blocklist entry, and monitoring for any future re‑hosting on alternative Cloudflare IPs. Organizations should also consider reviewing authentication logs for attempts that reference the page title or similar German‑language prompts, as these may indicate attempted credential harvesting. Continuous re‑assessment is advised, given the dynamic nature of Cloudflare‑hosted phishing infrastructure.