rewards-hydrex[.]app

Analysis indicates that the domain rewards-hydrex.app was registered on July 15 2026 via NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to IP 104.21.33.52. The domain is served by the Cloudflare name servers kip.ns.cloudflare.com and meera.ns.cloudflare.com. Threat intelligence sources have placed the domain on three security blocklists, and it is actively listed by PhishDestroy, MetaMask, and SEAL. VirusTotal scans have returned four positive detections out of ninety‑five antivirus engines, confirming a malicious classification. The domain is categorized as generic phishing and retains an active status, suggesting ongoing use in credential‑stealing campaigns. No additional public web‑content analysis such as page title, SSL certificate details, or HTTP response information is available at this time, leaving the exact phishing lure unknown. Defenders should immediately add rewards-hydrex.app to DNS and proxy blocklists, enforce outbound filtering to prevent connections to its IP address, and monitor for any authentication attempts targeting the domain. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds is advised to capture any evolution of the payload or additional detections. Given the recent registration date, rapid appearance on multiple blocklists, and positive AV detections, the domain presents a high‑risk profile and should be treated as hostile.