governance-hyperlend[.]com

The domain governance-hyperlend.com is currently flagged as a high‑risk brand‑impersonation campaign targeting Google. Registration data shows the domain was created on 2026‑04‑04 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare infrastructure, resolving to IP 188.114.97.3 located in Canada. The site presents an HTTP 403 response and the page title returned is “Just a moment…”, indicating that the landing page is not publicly accessible for further content analysis. TLS is provided by a Let’s Encrypt certificate (issuer YE1). The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports four detections out of ninety‑four scanners, and AlienVault OTX references the domain in eight threat‑intel pulses. Reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred. Nameservers are bingo.ns.cloudflare.com and guss.ns.cloudflare.com. While the exact malicious payload or credential‑harvesting mechanism has not been observed, the convergence of registration, hosting, blocklist presence, and detection metrics strongly suggests an active impersonation operation. Defenders should add governance-hyperlend.com and its resolving IP 188.114.97.3 to deny‑list rules, monitor DNS queries for related Cloudflare nameservers, and consider sharing indicators with upstream blocklist providers. Continuous re‑scanning is recommended to capture any evolution of the payload.