hamsterboost[.]io

The domain hamsterboost.io is currently active and has been classified as a generic_phishing threat with a high risk rating as of the 12 July 2026 report. The web server responds with HTTP status 200 and presents a valid Let’s Encrypt (R13) TLS certificate. The page title returned by the server matches the domain name, and no additional content analysis is available at this time.

Infrastructure analysis reveals that the domain was registered on 21 February 2026 through NameCheap, Inc. DNS resolution points to the address 172.66.158.173, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The hosting stack leverages Google Cloud services, fronted by Nginx and accelerated via Google Cloud CDN. Authoritative name servers are ns1.above.com and ns2.above.com, and an MX record with priority 50 directs mail to mx156.hostedmxserver.com. These components are typical of fast‑deploy phishing infrastructure that relies on reputable cloud providers to obscure origin.

Threat intelligence indicates the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal scans show that 2 of 95 security vendors have flagged the domain, while the Gridinsoft trust score is 0 out of 100, reinforcing a strong malicious confidence despite the low vendor count. No further public reports or detailed payload observations are currently available, leaving the exact phishing content uncertain.

Defenders should immediately add hamsterboost.io to network and email filtering blocklists and consider sinkholing the associated IP address 172.66.158.173 to prevent accidental connections. Monitoring for DNS queries to the above.com name servers and for any outbound traffic to the Cloudflare edge is recommended. Continuous re‑evaluation is advised, as the threat actor may modify hosting, certificates, or associated domains, and additional detection sources should be consulted on a regular basis.