app[.]hyperbaseliquid[.]xyz

The domain app.hyperbaseliquid.xyz was registered on 12 June 2026 through Global Domain Group LLC. It is hosted behind Cloudflare and resolves to IP 104.21.44.115, which is geolocated to Canada and associated with Cloudflare, Inc. The authoritative nameservers are ashton.ns.cloudflare.com and norah.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate (WE1). HTTP requests return a 403 status and the page title reported is "Just a moment…". VirusTotal analysis shows that 5 of 91 scanned security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0/100. The domain is classified as a generic phishing campaign employing brand impersonation, and it appears on a single security blocklist, with PhishDestroy confirming the block. Infrastructure indicates use of Cloudflare’s HTTP/3 support. The short age of the domain, combined with the low trust score and multiple vendor detections, suggests an active malicious operation. No additional content analysis is available beyond the page title. Defenders should block DNS resolution for app.hyperbaseliquid.xyz, enforce URL filtering, and monitor outbound connections to the associated IP address. Network traffic to the Cloudflare edge should be inspected for anomalous request patterns, and endpoint controls should be configured to prevent credential submission to this domain.