hyperspot[.]org

On July 23, 2026 analysts observed that hyperspot.org, a domain created on November 13, 2025 and registered through NiceNIC International Group Co., Limited, is currently offline but retains multiple indicators of compromise. The site was flagged by 13 of 95 VirusTotal security vendors, suggesting a substantive detection consensus. It appears on a single external blocklist and is explicitly blocked by PhishDestroy, confirming its classification as a wallet/seed phishing operation that impersonates the brand "across". The page title returned from the live endpoint reads "AML Risk Assessment Software - Fraud Risk Scoring Solution | Sumsub," a title unrelated to the alleged target, indicating possible content spoofing.

Infrastructure analysis shows the domain resolves to IP 172.67.216.86, hosted within the United States under ASN 13335 (Cloudflare, Inc.). The authoritative nameservers are becky.ns.cloudflare.com and yahir.ns.cloudflare.com, both Cloudflare‑managed, and no SSL certificate is presented, leaving the site vulnerable to downgrade attacks. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

While the domain is presently taken offline, its recent creation date, the presence on a blocklist, and the vendor detection count imply an active threat campaign that may re‑appear under a different host or subdomain. Defenders should continue to block the IP address 172.67.216.86 and the associated Cloudflare nameservers, monitor for re‑registration of the domain or similar patterns, and incorporate the observed page title and impersonated brand into URL and content‑based detection rules. Ongoing vigilance is recommended given the elevated risk rating and the potential for the actors to target users seeking AML or fraud‑scoring services.