Stored registration data identifies NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765) as the registrar. PhishDestroy maintains separate NiceNIC abuse-report research; registrar association is contextual and is not an independent detection for this domain.
Analysis of hpl-hyperlend.finance shows a newly registered domain created on February 22 2026 that is currently offline and returning HTTP 403 responses. The domain resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc., and is served behind Cloudflare’s infrastructure with HTTP/3 enabled. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS configuration. The authoritative nameservers are adam.ns.cloudflare.com and danica.ns.cloudflare.com, both Cloudflare‑managed.
The only visible page element is the title "Even geduld...", which provides no functional context and suggests the site content has not been publicly indexed. Reputation data indicates the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show three of ninety‑five vendors flag the domain, reinforcing a malicious classification despite the limited detection count. The combination of recent registration, Cloudflare hosting, a valid SSL certificate, and multiple blocklist entries aligns with known patterns of generic phishing infrastructure.
However, the exact phishing payload, target brand, or lure type cannot be confirmed because the site is offline and no page content has been captured. Defenders should continue to deny any network traffic to the domain, add the IP address 188.114.97.3 to deny‑list rules, and monitor for any re‑appearance of the domain or related subdomains. Ongoing observation of blocklist updates and VirusTotal submissions is recommended to capture any future changes in threat indicators.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
RDAP registration有效NICENIC INTERNATIONAL GROUP CO., LIMITED · IANA 3765RDAP HTTP 200source: Rdap Status CollectorclientDeleteProhibitedclientTransferProhibitedexpires 2027-02-12 23:36:37 UTCchecked 2026-08-07 04:42:46 UTC
Observed timelinelast reachable: 2026-09-15 22:17:59 UTCcurrent episode first observed: 2026-09-17 02:43:34 UTCobserved RIP window: 2026-09-15 22:17:59 UTC → 2026-09-17 02:43:34 UTC · 28.43hmidpoint estimate ≈ 2026-09-16 12:30:46 UTC · precision medium · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
技术 · 2 identified
Cloudflare
CDN
Web infrastructure and security company providing CDN, DDoS mitigation, and DNS services.
This timeline displays historical security and status checkpoints observed by the PhishDestroy automated monitoring network. It records domain lifecycle updates, scanner changes, and threat telemetry over time.
13 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
Web Archive
Preserved in 互联网档案馆 — historical evidence archived
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups+
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels+
Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
Send the report. Keep outgoing report records and recipient information when available.
Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
(RU)
PhishDestroy Investigation
