flareupdates[.]live

Analysis of flareupdates.live indicates an active credential phishing domain registered on April 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is currently resolving to 188.114.96.3, a Cloudflare IP address located in Canada, and is protected by Cloudflare nameservers (robert.ns.cloudflare.com, imani.ns.cloudflare.com). The site returns an HTTP 403 status with a page title of 'Just a moment...', a common response from Cloudflare-protected phishing pages attempting to evade detection or automated crawling. Security vendors have flagged this domain, with three out of 94 detecting it as malicious, and it appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. Infrastructure analysis reveals the use of HSTS, Cloudflare Browser Insights, and HTTP/3, suggesting an attempt to appear legitimate while leveraging Cloudflare's security and performance features to obscure the true origin of the phishing content. The exact nature of the phishing campaign remains unclear due to the lack of visible content, but the domain is explicitly categorized as a credential phishing threat. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS, network, and endpoint levels. Given its Cloudflare hosting, traditional IP-based blocking may be ineffective, so domain-based blocking or sinkholing is recommended. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats. No specific brand targeting has been confirmed, so generic phishing detection rules should be applied until further analysis is conducted.