troupdate[.]live

Analysis of the domain troupdate.live indicates active credential phishing infrastructure as of July 24, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). The site returns an HTTP 403 status with the page title 'Just a moment...', a common Cloudflare interstitial response that may obscure malicious content from automated scans. Infrastructure analysis reveals the use of Cloudflare nameservers (tegan.ns.cloudflare.com and jaime.ns.cloudflare.com), HSTS enforcement, HTTP/3, and Cloudflare Browser Insights, suggesting an attempt to appear legitimate while leveraging Cloudflare's security features to evade detection.

Four of 93 security vendors on VirusTotal have flagged this domain, and it appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), which is not inherently suspicious but is consistent with domains attempting to blend in with legitimate traffic. The domain's scam type is explicitly classified as credential phishing, though the specific brand or service being impersonated remains unconfirmed due to the lack of visible page content or additional brand indicators in the available data. Defenders should treat this domain as high-risk.

The combination of Cloudflare hosting, a recent registration date, blocklist presence, and credential phishing classification warrants immediate blocking at the network and endpoint levels. Security teams are advised to monitor for connections to 188.114.96.3 or the domain itself in logs, particularly those involving authentication attempts or sensitive data transmission. Given the HTTP 403 response, the site may be selectively serving content to evade analysis, so sandboxed or manual inspection should be conducted with caution.