governance-hyena[.]trade

The domain governance-hyena.trade was observed on July 25, 2026 and is currently listed as offline. The sole HTTP response captured a page title of “Just a moment…”, indicating that the site returned a minimal placeholder rather than a fully rendered phishing page. Registration data shows the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited, and it resolves to the Cloudflare address 172.67.200.238 (AS13335, United States). No TLS certificate was presented, confirming that the site operated without HTTPS encryption. The authoritative nameservers are adam.ns.cloudflare.com and danica.ns.cloudflare.com, both standard Cloudflare services.

Reputation checks reveal that the domain is present on three external blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklist providers. VirusTotal analysis recorded three positive detections out of ninety‑three scanners, reinforcing the suspicion of malicious intent. No additional threat‑intel platforms such as OTX or Safe Browsing were cited in the available data.

Given the combination of a recent registration, Cloudflare hosting, absence of TLS, and multiple independent detections, the domain should be treated as a confirmed phishing vector. Defenders are advised to add governance-hyena.trade to network‑level deny lists, enforce DNS‑based blocking, and monitor for any resurgence of activity. Continuous re‑scanning is recommended, as the current offline status may change and the site could later host credential‑harvesting pages. Until further content analysis is possible, the observed indicators constitute sufficient evidence for elevated risk handling.