canopynetwork[.]app

canopynetwork.app was first observed on February 21, 2026 and is currently active with a high risk rating for a generic phishing campaign. The site returns an HTTP 301 redirect and presents the page title “Success!”. Analysis of the web content and metadata indicates that the domain is being used to lure victims into providing credentials or personal information, consistent with the observed classification. Infrastructure analysis reveals that the domain resolves to the IP address 172.67.186.8, which belongs to a large content delivery network (ASN 13335). The site is protected by a certificate issued by a recognized certificate authority (WE1) and serves traffic over HTTP/3, confirming the use of modern web protocols. Nameservers cloe.ns.cloudflare.com and mitch.ns.cloudflare.com are configured, indicating that the domain’s DNS is fully managed through the CDN provider. Threat intel shows the domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal scans have flagged the domain in three out of ninety‑five security vendors, reinforcing the suspicion of malicious intent. The combination of a generic success page title, a recent registration date, and the presence on phishing‑focused blocklists provides concrete evidence of a credential‑harvesting operation, although the exact payload or landing page content was not captured during analysis. Defenders should immediately block traffic to canopynetwork.app at the network perimeter and add the domain to URL filtering policies. Continuous monitoring of DNS queries for the associated nameservers is advised, as well as the deployment of sink‑hole redirects to mitigate user exposure. Security teams should also share the indicator set with threat‑sharing platforms to accelerate collective response.