hotstuff-app[.]xyz

PhishDestroy identifies hotstuff-app.xyz as a HotStuff protocol-themed phishing domain currently active and under investigation as of April 2026. This domain mimics legitimate HotStuff blockchain or consensus protocol services to deceive users into disclosing credentials or cryptocurrency-related information. The campaign is classified under generic_phishing with no current blocklist detections, indicating a newly launched but unflagged threat vector.

This domain was flagged by 1 of 95 VirusTotal vendors, suggesting it remains undetected by most security engines as of the latest scan. It is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, resolving to IP address 188.114.97.3. The domain was created on April 08, 2026, and secured with a Let’s Encrypt SSL certificate. These technical indicators reveal a rapidly deployed infrastructure using reputable hosting and certificate authorities to enhance credibility. The lack of detections and low age make this domain particularly dangerous to users unfamiliar with HotStuff-related services.

Given the active status and absence of detections, immediate caution is advised when encountering hotstuff-app.xyz or any subdomains. Users are recommended to avoid interacting with the domain or its linked content, especially if soliciting cryptocurrency transactions or credential input. Security teams should add 188.114.97.3 and hotstuff-app.xyz to network blocklists and inspect DNS resolutions for related domains. Organizations should also warn users about spoofed HotStuff protocol communications and monitor for credential harvesting attempts under this campaign identifier 1e9271.