hastraupdate[.]live

Analysis of hastraupdate.live indicates an active credential phishing domain registered on February 21, 2026, through NiceNIC International Group Co., Limited. The domain currently resolves to IP address 188.114.97.3 and is flagged by 23 threat intelligence pulses in AlienVault OTX, suggesting widespread detection in security communities. Six of 95 security vendors on VirusTotal classify this domain as malicious, while two independent blocklists have listed it. The page title 'Just a moment...' is consistent with intermediate or cloaked phishing pages, often used to evade automated detection before redirecting victims to fraudulent login forms. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, which may obscure origin servers and complicate takedown efforts. The domain's Gridinsoft trust score of 0/100 further supports its classification as high-risk. No specific brand impersonation or phishing kit has been confirmed in available data, though the credential phishing designation implies targeting of login credentials rather than financial or personal data directly. Defenders should block the domain and its resolving IP at network perimeter controls, monitor for connections from internal assets, and investigate any prior interactions. Given its continued activity as of July 12, 2026, and lack of remediation, this domain remains a credible threat.