hourlybull[.]com

Analysis of hourlybull.com indicates the domain is being used for phishing. The site responded with HTTP 200 and presented a page titled "Security Check …", a common placeholder used in credential‑harvesting flows. The domain was created on 29 Oct 2025 and is hosted on IP 185.186.55.34, which belongs to the French ASN AS209003 (Genius Guard). The hosting provider’s name servers are ns1‑ns4.easy-geo-dns.com, a pattern frequently observed in malicious infrastructure. MX records resolve to "localhost", suggesting no legitimate mail service and reinforcing the likelihood of abuse.

The SSL certificate presented is issued to "PhishDestroy / botadmin.destroy.tools", a certificate commonly associated with takedown or sink‑hole operations, confirming that the domain has already been identified as malicious. Trust scoring services assign a zero‑score (0/100) from Gridinsoft, and the domain is listed on at least one public blocklist. VirusTotal scans returned three positive detections out of ninety‑five engines, and the domain is explicitly blocked by the PhishDestroy service. Registration was performed through CSL Computer Service Langenbach GmbH d/b/a joker.com, a registrar known to host abusive domains.

The current operational status is offline, indicating that the site has been taken down or is no longer serving content, but the historical evidence remains relevant for threat‑intel correlation. Uncertainties include the exact phishing campaign payload and target audience, as no further page content or lure details have been captured. Defenders should continue to block the domain at network perimeter, add the IP and associated name servers to deny lists, and monitor for any re‑registration attempts or similar infrastructure patterns. Ongoing vigilance is advised, especially for users who may have previously received emails referencing hourlybull.com.