hyperstaking-onbeam[.]com

This domain, hyperstaking-onbeam.com, is identified as a brand impersonation threat targeting Google. Analysis indicates the infrastructure was designed to mimic legitimate Google services, likely to deceive users into disclosing credentials or interacting with malicious content. The page title "WanderSphere Blog" does not align with Google’s branding, suggesting an attempt to obfuscate the true intent of the site while leveraging a recognizable brand for credibility.

Infrastructure analysis reveals the domain was registered on September 19, 2025, through OwnRegistrar, Inc., and resolved to the IP address 188.114.97.3. VirusTotal detections show 2 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100. At the time of analysis, Google Safe Browsing (GSB) had not listed the domain, though this may reflect a delay in detection rather than an absence of risk.

The domain is currently offline, having been taken down following identification as a phishing threat. Despite its inactive status, residual risk remains due to the potential for the infrastructure to be reactivated or repurposed. Users who may have interacted with the domain are advised to monitor for unauthorized account access, reset credentials associated with Google services, and verify the legitimacy of any communications referencing this domain. Organizations should update blocklists to include this domain and its associated IP to prevent future exposure.