claim[.]hyperlanefoundation[.]today

Analysis of the domain claim.hyperlanefoundation.today indicates that it was being used as a crypto‑drainer operation before being taken offline. The site was registered through Cloudflare, Inc., and the hosting IP resolves to the IPv6 address 2a06:98c1:3120::3, which is announced by AS13335 owned by Cloudflare and geolocated to the United States. No TLS certificate was present, meaning the site served content over plain HTTP. The only visible HTML element is the page title “Et øjeblik …”, which provides no indication of the intended victim target.

Scamadviser rates the domain with a trust score of 1 out of 100, classifying it as a crypto scam. VirusTotal recorded detections from two of ninety‑five security vendors, confirming that at least a minority of scanners flagged the domain as malicious. The domain appears on a single public blocklist and is explicitly blocked by the PhishDestroy service. Current activity status is listed as offline, so automated requests now return no response.

The evidence confirms that the infrastructure was deliberately obscured behind Cloudflare’s network and that the operative purpose was to lure victims into sending cryptocurrency, consistent with the “crypto drainer” classification. Uncertainty remains regarding the exact phishing kit or the specific cryptocurrency addresses advertised, as no further page content has been disclosed. Defenders should continue to block the domain at perimeter filters, add the IPv6 host to threat intel feeds, and monitor for any re‑registration or resurrection of the URL, especially given its low trust score and prior vendor detections. Ongoing vigilance is advised because the lack of SSL and the use of Cloudflare may be replicated by other actors.