hoodiefun[.]xyz

Analysis as of August 06, 2026 identifies hoodiefun.xyz as an active generic phishing infrastructure. The domain was registered three days prior, on August 03, 2026, through Global Domain Group LLC. Authoritative name servers listed are fish.ns.cloudflare.com and joel.ns.cloudflare.com, indicating the use of Cloudflare DNS services. DNS resolution points to the IPv4 address 188.114.96.10, which is the sole host observed for this domain. The IP is not currently associated with known benign services and should be considered part of the malicious supply chain. VirusTotal records show that the domain was submitted to 91 scanning engines, none of which raised a detection.

The absence of a flag does not constitute a safety assurance; many phishing sites evade static analysis and rely on dynamic content. The domain is already listed on a single security blocklist and is actively blocked by the PhishDestroy feed, confirming that threat‑intelligence communities have observed malicious activity linked to the host. No public SSL certificate data, HTTP status codes, or page title information have been released, so the content served by the domain remains unverified. Consequently, the exact phishing campaign payload, targeted brand, or credential‑harvesting technique cannot be described at this time. The short lifespan of the domain, combined with the rapid deployment of Cloudflare name servers, suggests a “throwaway” operational model typical of opportunistic phishing operators.

Defenders should prioritize immediate containment by adding hoodiefun.xyz and its resolving IP 188.114.96.10 to network‑level deny lists, DNS‑sinkhole rules, and endpoint web‑filter policies. Continuous monitoring of the IP address for new associations, as well as periodic re‑scans on VirusTotal or similar platforms, is recommended to detect any evolution of the payload.