hybra-finance[.]app

This domain, hybra-finance.app, was registered on 17 November 2025 through NiceNIC International Group Co., Limited. DNS resolution points to the IPv4 address 95.214.235.117, which is announced by AS30860 (Virtual Systems LLC) and geolocated to Ukraine. The authoritative name servers are ns13.v-sys.org and ns14.v-sys.org. No TLS certificate is presented, and an HTTP request returns a generic directory listing with the page title “Index of /”. The site is currently offline, indicating that the operator has taken the infrastructure down. Reputation signals show elevated risk.

The domain appears on two public security blocklists and is actively blocked by PhishDestroy and ScamSniffer. On VirusTotal, six of ninety‑five scanning engines flagged the domain as malicious, reinforcing the suspicion of phishing use. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. No additional context such as safe‑browsing status, OTX tags, or malware kit attribution is available. Given the observed infrastructure—recent registration, Ukrainian hosting, lack of encryption, and multiple independent detections—defenders should treat hybra-finance.app as a confirmed phishing vector.

Network perimeter tools should block outbound connections to the resolved IP and the domain name. Endpoint detection platforms should incorporate the domain and its IP into deny lists. Continuous monitoring of the IP range owned by AS30860 is recommended in case the operator re‑hosts similar payloads. Because the site is offline, any residual artifacts (e.g., email links or cached pages) should be examined for indicators of compromise. Further analysis of captured traffic or logs may reveal additional payloads or target campaigns.