dashboard-compoundlabs[.]xyz

The domain dashboard-compoundlabs.xyz was registered through Dynadot LLC on April 14, 2026. Its authoritative name servers are kyrie.ns.cloudflare.com and pat.ns.cloudflare.com, and it resolves to the Cloudflare‑owned address 188.114.97.3, which geolocates to Canada. The use of Cloudflare’s network and a recent registration date are consistent with fast‑deployment phishing infrastructure. The site presents an HTTP 403 response and the browser‑visible title reads “Just a moment…”. The TLS certificate is issued by Let’s Encrypt (certificate identifier E7), indicating a valid, automatically‑renewed certificate. The combination of a generic error page and a legitimate certificate is a common tactic to bypass basic URL‑based filters while presenting a seemingly trustworthy connection. Threat intelligence sources have flagged the domain as a brand‑impersonation of Compound. It appears on three public blocklists, has been blocked by PhishDestroy, MetaMask, and SEAL, and is referenced in one AlienVault OTX pulse. VirusTotal scans show that three out of ninety‑five security vendors have raised detections, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. While the current content is limited to a generic blocking page, the domain’s association with the Compound brand and its presence on multiple blocklists suggest an active phishing campaign targeting users of the Compound platform. Uncertainty remains regarding the specific payload or credential‑harvesting mechanism, as no malicious scripts have been observed in the delivered page. Defenders should block the domain at the DNS and proxy layers, monitor for any outbound connections to the 188.114.97.3 address, and update detection signatures to include the observed TLS certificate and page title. Continuous monitoring of related blocklist entries and OTX updates is advised to capture any evolution of the campaign.