signup-hyena[.]xyz

This domain, signup-hyena.xyz, is flagged as an active phishing infrastructure by multiple security vendors. Registered on February 23, 2026, through Dynadot LLC, the domain currently resolves to 188.114.96.3, an IP address assigned to Cloudflare, Inc. (AS13335) in the United States. The domain uses Cloudflare nameservers (jerome.ns.cloudflare.com and ollie.ns.cloudflare.com) and is protected by a Google Trust Services SSL certificate (WE1).

At the time of analysis, the domain returns an HTTP 403 status, with a page title indicating a 504 Gateway Time-out error, which may suggest either misconfiguration or deliberate evasion of automated scans. Three of 93 security vendors on VirusTotal have flagged this domain, and it appears on two security blocklists, including PhishDestroy and ScamSniffer. The domain is classified as a generic phishing threat, though the specific target or phishing kit in use remains unconfirmed due to the lack of accessible page content.

Defenders should treat this domain as high-risk infrastructure, particularly given its Cloudflare hosting and recent registration. Network-level blocking is recommended, along with monitoring for any shifts in HTTP status or page content that may indicate renewed phishing activity. The domain remains active as of July 25, 2026, and no takedown action has been observed.