hyperscale-nft[.]pages[.]dev

Analysis of hyperscale-nft.pages.dev shows a newly registered site (created 25 April 2026) that returns HTTP 200 and presents the page title “Hyperscale”. The host is served through Cloudflare’s network (nameservers norm.ns.cloudflare.com and raegan.ns.cloudflare.com) and resolves to IP 188.114.96.3, which is mapped to Cloudflare, Inc. in Canada. TLS termination is provided by Google Trust Services with a WE1 certificate, and the site enforces HSTS while supporting HTTP/3. Security reputation is poor: Gridinsoft assigns a trust score of 0 / 100, the domain appears on one security blocklist, and PhishDestroy has listed it as blocked. VirusTotal scans flag the domain in 4 of 91 vendors, confirming malicious activity. The listed scam type is “Crypto Drainer”, indicating attempts to illicitly siphon cryptocurrency assets from victims. At present no additional intelligence such as payload samples or command‑and‑control endpoints is available, and the exact phishing lure or victim profile has not been disclosed. Defenders should block the domain at the DNS and web‑filter layers, monitor outbound connections to the Cloudflare IP address, and enforce strict validation of any unsolicited cryptocurrency transaction requests. Ongoing surveillance is recommended to capture any evolution of the infrastructure or emergence of associated indicators of compromise.