app-hyperliduidl[.]eu[.]com

This domain, app-hyperliduidl.eu.com, is classified as a generic phishing site with a high risk rating and remains active as of 12 July 2026. The domain was created on 21 February 2026 and is registered through Instra Corporation Pty Ltd. The unique seed identifier 857bc0 links this observation to the current intelligence set. Technical resolution shows the domain pointing to IP address 104.21.96.1, which belongs to AS13335 operated by Cloudflare, Inc. The hosting infrastructure uses Cloudflare services and supports HTTP/3. The SSL certificate presented is issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain. Nameservers are ns1.centralnic.net through ns4.centralnic.net. The Gridinsoft trust score for the domain is 0 out of 100, indicating a complete lack of trust. Web requests return an HTTP 521 status code and the page title reports a 522: Connection timed out, suggesting that the origin server is not responding. The domain is listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal analysis shows a single detection out of 95 security vendors, reflecting limited but present malicious indicator coverage. While the available data confirms the domain’s phishing classification, the exact payload, targeted brand, or credential‑stealing mechanisms have not been observed. The connection timeout prevents retrieval of the landing page content, leaving the specific lures or form structures unknown. The low detection count on VirusTotal may be due to the brief exposure window or evasion techniques. Defenders should proactively block traffic to app-hyperliduidl.eu.com at network perimeters and DNS resolvers. Continuous monitoring of the IP 104.21.96.1 and associated Cloudflare edge nodes is advised, as the infrastructure can be reused for other malicious domains. Adding the domain to internal threat intelligence feeds and correlating future alerts with the unique seed 857bc0 will aid in early detection of related campaigns.