etxupdates[.]live

This domain, etxupdates.live, is under investigation for credential phishing, a threat type involving the fraudulent capture of authentication credentials through deceptive interfaces. The infrastructure was operational but has since been taken offline, though prior activity suggests intent to harvest login details for malicious purposes.

Analysis indicates the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 188.114.96.3 and is associated with an SSL certificate issued by Google Trust Services. At the time of assessment, the domain appeared on one security blocklist, though it had not yet been flagged by detection engines, with a VirusTotal score of 0/95. Technologies detected include Cloudflare and HTTP/3, and the page title displayed was 'Just a moment...', a common indicator of intermediary or proxy-based redirection.

Mitigation for credential phishing threats involves immediate domain blacklisting at the network level, particularly for the IP 188.114.96.3. Organizations should monitor for connections to this infrastructure and review logs for prior interactions. End-user education should emphasize verifying domain authenticity before entering credentials, especially for domains created recently or exhibiting unusual redirection behavior. If the domain reactivates, security teams should prioritize forensic analysis of its hosting environment and certificate chain to identify additional indicators of compromise.