app[.]altlayer[.]cam

Analysis of app.altlayer.cam shows a newly registered domain (created 29 April 2026) hosted behind Cloudflare (IP 188.114.96.3, location CA). The domain resolves to Cloudflare nameservers uriah.ns.cloudflare.com and zara.ns.cloudflare.com and presents a TLS certificate issued by Let’s Encrypt (CN E8). HTTP requests return status 403 and the only observable page title is “Just a moment…”, indicating that the site is likely serving a redirect or challenge page rather than legitimate content. The domain has a Gridinsoft trust score of 0 / 100 and is listed on one security blocklist. Two of ninety‑one VirusTotal scanners have flagged the host, and the phishing‑specific blocklist PhishDestroy currently blocks it. The registration was performed through Dynadot LLC. No additional intelligence such as a targeted brand, phishing kit, or landing‑page screenshot is available, so the exact payload or credential‑harvesting method remains unknown. Given the active status, low trust score, and multiple security detections, defenders should add app.altlayer.cam to deny‑list rules, monitor DNS queries for the associated Cloudflare IPs, and isolate any internal traffic that attempts to reach the domain. Continuous re‑evaluation is advised in case the site begins serving malicious content.