eligibility-hyena[.]trade

Eligibility-hyena.trade was registered on February 21, 2026 through NameSilo, LLC and is currently resolved to the Cloudflare‑provided address 188.114.96.3 (AS13335, United States). The domain is served by Cloudflare DNS (garret.ns.cloudflare.com, lindsey.ns.cloudflare.com) and does not present an SSL/TLS certificate, resulting in an unsecured HTTP connection that returns the generic page title "Just a moment...". At the time of analysis the site is offline, limiting direct inspection of the payload.

Independent scanning on VirusTotal recorded four detections out of ninety‑three security vendors, indicating that multiple scanners have flagged the domain as malicious. The same domain appears on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that threat‑intelligence feeds consider it unsafe. An AlienVault OTX pulse references the domain in one threat‑intel record, and the infrastructure matches the known Airdrop Scam phishing kit, suggesting the site was intended to lure victims with a fraudulent cryptocurrency airdrop promise.

The combination of recent registration, Cloudflare hosting, lack of TLS, low‑visibility page title, and multiple vendor detections collectively raise the risk profile. Defenders should add the domain to URL filtering rules, monitor DNS queries for the associated IP and hostnames, and ensure endpoint protection solutions are updated to reflect the four VirusTotal detections. Continuous watching of the domain’s status is advised, as re‑activation could occur on the same infrastructure.