p2-hourglass[.]app

The domain p2-hourglass.app is currently hosted behind Cloudflare’s infrastructure. DNS resolution shows the authoritative name servers brett.ns.cloudflare.com and gloria.ns.cloudflare.com, both owned by Cloudflare, Inc. The domain resolves to IP address 188.114.96.3, which is advertised as a US‑based endpoint within Autonomous System 13335, the Cloudflare network. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, and an HTTP 403 response is returned for the root URL. Detected technologies include Cloudflare Browser Insights and HTTP/3 support, indicating use of modern CDN features.

Threat intelligence flags the site as a high‑risk generic phishing vector. VirusTotal has recorded one positive detection out of ninety‑five scanned engines, and Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed. Its risk level is marked high, and the status remains active, confirming that the malicious infrastructure is still reachable.

Defenders should immediately add p2-hourglass.app to URL filtering and DNS sinkhole lists to prevent client connections. Network monitoring rules that inspect TLS SNI or HTTP Host headers for the exact domain can be used to enforce block actions. Given the Cloudflare front end, any attempt to bypass the block by leveraging alternative subdomains will likely resolve to the same IP range, so broader Cloudflare‑associated IP blocks may be considered in high‑sensitivity environments. Continuous re‑scanning of the domain on VirusTotal and other multi‑engine services is advisable to capture any changes in detection confidence.