just-update[.]live

This domain, just-update.live, is currently active and classified as a credential phishing site. The domain was registered on 23 April 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted behind Cloudflare’s network (IP 172.67.130.118, located in Canada). The site presents a HTTP 403 response and serves a page titled “Just a moment…”, indicating the presence of Cloudflare’s challenge page rather than the phishing payload itself. The SSL certificate is issued by Let’s Encrypt (E8). Infrastructure analysis shows the authoritative nameservers nash.ns.cloudflare.com and diana.ns.cloudflare.com, both belonging to Cloudflare. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, three of ninety‑four VirusTotal scanners flag the domain, and it appears on one public blocklist. The domain is also listed in an AlienVault OTX pulse and has been blocked by the PhishDestroy feed. Although the exact phishing landing page has not been captured, the combination of recent registration, low trust scores, and multiple threat‑intelligence references strongly suggests malicious intent aimed at harvesting credentials. Defenders should block the domain at DNS and proxy layers, monitor for outbound connections to the associated IP, and update email filters to reject messages referencing just‑update.live. Continuous re‑evaluation is advised in case the site changes its content or hosting configuration.