pre-hourglass[.]com

This domain is flagged as an elevated-risk phishing infrastructure specifically designed to impersonate institutional stablecoin yield services. Analysis indicates the threat type is credential harvesting and financial fraud, targeting users of cryptocurrency platforms through deceptive yield offerings. The page title, 'Hourglass - institutional yield for stablecoins,' directly mimics legitimate financial service branding to exploit trust in high-value digital asset management. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain pre-hourglass.com was registered on November 06, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with phishing operations. It resolves to the IP address 94.183.185.140 and is currently offline, though prior activity remains a verified threat. Security vendors on VirusTotal flagged the domain at a 4/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on two independent security blocklists, and its infrastructure was blocked by multiple anti-phishing systems, confirming its role in active phishing campaigns. Mitigation requires immediate action from both end users and security teams. Users who accessed this domain should revoke any connected wallet permissions, rotate credentials for all linked financial accounts, and monitor for unauthorized transactions. Security teams should add the domain and its resolving IP (94.183.185.140) to perimeter blocklists, conduct internal sweeps for related indicators, and alert users about stablecoin-themed phishing risks. Given the institutional targeting, organizations handling digital assets should enforce multi-factor authentication and transaction signing requirements to prevent credential-based breaches.