mntrupdate[.]live

The domain mntrupdate.live was registered on 21 February 2026 through NiceNIC International Group Co., Limited. It is hosted on Cloudflare’s network (ASN 13335) and resolves to the address 172.67.167.20, which is located in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 intermediate, and the connection enforces HSTS while supporting HTTP/3. An HTTP request returns status code 403 and the only observed page title is “Just a moment…”, indicating that the landing page is not currently serving phishing content.

The domain has been categorized as a credential phishing site and is listed on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal scans show that 13 out of 93 security vendors have flagged the domain as malicious. The infrastructure uses the standard Cloudflare nameservers roan.ns.cloudflare.com and michelle.ns.cloudflare.com. The site is presently taken offline, but its recent creation and rapid appearance on multiple blocklists suggest a short‑lived phishing campaign.

Concrete evidence of the phishing payload, targeted brands, or credential‑harvesting forms has not been published, so the exact lure and victim profile remain unknown. Defenders should proactively block mntrupdate.live at DNS and proxy layers, add the domain to URL filtering rules, and monitor for any resurgence of the same IP or Cloudflare nameserver pair. Continuous threat‑intel feeds should be consulted for updates, and any detection alerts from the listed blocklists or VirusTotal should be escalated for incident response. Given the credential‑phishing classification, organizations handling employee login credentials should treat any traffic to this domain as high‑risk.