flr-update[.]live

This domain flr-update.live was registered on May 01, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 172.67.180.125 in CA and uses nameservers lara.ns.cloudflare.com together with hassan.ns.cloudflare.com. The SSL certificate was obtained from Let's Encrypt under identifier E8. The domain carries an active status and is classified under credential phishing with a high risk level as of the July 12, 2026 report date. HTTP responses from the host return status code 403.

Detection data shows that 4 out of 95 security vendors flag the domain on VirusTotal. It appears in one AlienVault OTX threat intelligence pulse and is present on one security blocklist. The Gridinsoft trust score stands at 0 out of 100. These metrics indicate observable malicious association without reliance on any single source.

What remains uncertain includes the precise ownership behind the NICENIC registration and the exact payload or target brand involved in the credential theft operation. The 403 response prevents direct content inspection, leaving infrastructure details limited to the provided resolution and certificate data. No additional ASN or kit specifics are recorded in the available intelligence.

Defenders should incorporate the IP 172.67.180.125 and the listed nameservers into monitoring and filtering rules. Blocking or sinkholing traffic to flr-update.live based on the documented detections and blocklist presence reduces exposure. Continued tracking of the domain through existing threat feeds supports timely updates to protective measures.