spot-hiberix-opt[.]net

Analysis as of July 24 2026 indicates that spot-hiberix-opt.net is a newly registered domain used for phishing. The domain was created on 21 February 2026 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to 104.21.76.47, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are anastasia.ns.cloudflare.com and george.ns.cloudflare.com, confirming that the site is hosted behind Cloudflare's edge network. No TLS certificate was presented when the site was queried, suggesting that HTTPS was not configured or that the service was terminated prior to capture. The HTTP response returned the page title “Suspected phishing site | Cloudflare”, which is a generic placeholder displayed by Cloudflare when a site is taken down or flagged.

VirusTotal recorded a single positive detection out of 93 scanning engines, indicating that at least one vendor identified malicious activity. The Gridinsoft trust score of 0/100 further corroborates a lack of credibility. The domain has been listed on one security blocklist and is actively blocked by the PhishDestroy sinkhole, and its current status is offline. While the available data confirms the presence of phishing infrastructure, the specific target brand, credential‑harvesting page, or lure technique has not been disclosed in public feeds. Consequently, the exact phishing campaign details remain uncertain.

Given the short lifespan of the domain—less than five months at the time of analysis—its rapid deployment aligns with typical phishing infrastructure turnover. The use of Cloudflare's CDN may be intended to obscure the true hosting environment and to benefit from the provider's global edge caching. No additional evidence such as URL paths, payload samples, or phishing kits has been published, so threat actors’ specific objectives cannot be inferred. Defenders should add spot-hiberix-opt.