On July 16, 2026 the domain bullhype.xyz was registered through NameSilo, LLC. The domain is delegated to Cloudflare’s authoritative name servers carlos.ns.cloudflare.com and walk.ns.cloudflare.com and resolves to the IP address 172.67.203.230, a Cloudflare edge node that is commonly used by malicious actors to hide origin infrastructure. The domain appears on a single public security blocklist and is listed as blocked by PhishDestroy, indicating that at least one anti‑phishing service has observed malicious use. VirusTotal reports that the domain has been scanned by 91 AV engines, none of which flagged it at the time of analysis; the absence of detections does not imply benign intent, especially given the recent creation date and the presence on a blocklist.
No public HTTP response codes, SSL certificate details, or page‑title information are currently available, limiting the ability to confirm the exact phishing payload or targeted brand. The short lifespan of the domain, combined with the use of a shared CDN and the blocklist entry, aligns with typical infrastructure patterns observed in credential‑harvesting campaigns.
Defenders should treat bullhype.xyz as a high‑confidence phishing indicator: incorporate the domain and its associated IP address into URL filtering, DNS sink‑hole, and firewall rule sets; monitor for any DNS queries or outbound connections to the IP; and consider proactive takedown requests with the registrar if further malicious activity is observed. Ongoing telemetry collection is recommended to capture any future changes in hosting, content, or detection status.