tge-hyperlend[.]finance

Analysis of tge-hyperlend.finance shows a short‑lived infrastructure that was actively used for a phishing campaign before being taken offline. The domain was registered through NiceNIC International Group Co., Limited on 21 February 2026 and immediately pointed to Cloudflare’s network, resolving to IP 18.222.140.9, which belongs to AS13335 (Cloudflare, Inc.) in the United States. DNS resolution is handled by the Cloudflare nameservers trevor.ns.cloudflare.com and itzel.ns.cloudflare.com, indicating reliance on Cloudflare’s edge services for traffic routing and protection.

The site presented the page title “HyperLend”, but no further content has been captured; the HTTP response returned a 403 status code, suggesting that the server was configured to deny access or that the content was removed after detection. The TLS certificate was issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate certificate chain.

Security scanners on VirusTotal flagged the domain in 4 of 93 vendor checks, reflecting modest detection across the ecosystem. Independent blocklists have already listed the domain, with PhishDestroy, MetaMask, ScamSniffer, and SEAL confirming the malicious classification. The domain also appears on four additional security blocklists, reinforcing its reputation as a phishing vector.

Defenders should immediately block tge-hyperlend.finance at perimeter and DNS layers, and add the associated IP address 18.222.140.9 to any host‑based deny lists. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is advised, as the attacker may reuse the same infrastructure for future campaigns. Since the site is currently offline, retrospective forensic collection may be limited, but threat‑intel feeds should be updated with the registration details, nameserver configuration, and certificate information to aid correlation with future incidents.