signal[.]beboundless[.]us

signal.beboundless.us is an active generic phishing infrastructure observed on July 12, 2026. The domain was registered on July 16, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted behind Cloudflare (IP 104.21.32.1, AS13335, United States). DNS resolution uses the Cloudflare authoritative nameservers elsa.ns.cloudflare.com and devin.ns.cloudflare.com. TLS termination is provided by a Google Trust Services / WE1 certificate, and the site presents Cloudflare Browser Insights, Cloudflare, and HTTP/3 technologies. HTTP requests receive a 403 status and the only visible page title is “Just a moment…”. The domain is listed on one public blocklist and is currently blocked by PhishDestroy. VirusTotal analysis shows that 2 of 95 security vendors have flagged the domain, indicating a low but non‑zero detection rate. The threat intelligence classifies the activity as Messenger Phishing, suggesting attempts to harvest credentials via a messaging platform, although the exact target or payload has not been publicly disclosed. Uncertainty remains regarding the specific phishing page content and any associated command‑and‑control infrastructure. Defenders should block the domain and its resolving IP at network perimeters, monitor DNS queries for the domain and its nameservers, and add the domain to endpoint and email security block lists. Continuous re‑evaluation is advised as additional detections may emerge.