hyperskids[.]next-cryptolist[.]net

This domain, hyperskids.next-cryptolist.net, was registered on 2026-04-11 through a registrar operated by Key-Systems GmbH and is currently hosted behind a content delivery network that terminates TLS with a certificate issued by a public trust service (WE1). DNS resolves to 104.21.64.107, an address located in Canada and associated with the CDN’s edge network. Both authoritative name servers (hunts.ns.cloudflare.com, nena.ns.cloudflare.com) belong to the same provider. HTTP requests return a 403 status, indicating restricted access, while the service advertises HTTP/3 support. The domain has a trust score of 0 out of 100 and appears on a single blocklist, where it is listed by PhishDestroy. VirusTotal scans show 18 of 94 security vendors flag the domain as malicious. The risk rating is high and the status is active. Evidence confirms that the infrastructure is intentionally concealed behind a reputable CDN, and the low trust score together with multiple vendor detections point to a phishing campaign. However, no content analysis or page payload has been observed, so the exact phishing lure remains unknown. Defenders should block DNS resolution and HTTP traffic to this host, monitor for connections to the associated IP, and incorporate the domain into existing URL filtering and intrusion‑detection rules. Continued observation is advised to capture any payload or credential‑stealing activity.