wormhole[.]hyperspace[.]work

This domain wormhole.hyperspace.work is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Wormhole brand. The site was registered on May 07 2025 through a registrar that uses Cloudflare’s DNS service; its authoritative nameservers are kyle.ns.cloudflare.com and sasha.ns.cloudflare.com. DNS resolution points to IP 172.64.148.249, which belongs to AS13335, a Cloudflare network located in the United States. HTTPS is enforced via HSTS and the presented certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS chain. An HTTP request returns status 403, suggesting the server is deliberately restricting access. Security intelligence shows a Gridinsoft trust score of 0/100 and Google Safe Browsing flags the URL for SOCIAL_ENGINEERING. Ten of ninety‑five VirusTotal scanners have raised detections, and the domain appears on a single external blocklist, currently blocked by PhishDestroy. The page title returned is “Wormhole”, matching the declared brand target and the scam type “Bridge Scam”. While the exact phishing page content has not been analysed, the combination of brand impersonation, low trust score, and multiple vendor detections indicates a credible threat. Defenders should add the IP and domain to outbound and inbound filtering rules, monitor DNS queries for the two nameservers, and ensure endpoint protection updates include the observed VirusTotal signatures. Continuous observation of any changes in HTTP response codes or additional blocklist listings is recommended.