hextrustreward[.]com

hextrustreward.com has been flagged for active crypto-draining phishing tactics. The domain mimics legitimate reward programs from established crypto custodians to trick users into connecting wallets and draining funds. PhishDestroy identifies this infrastructure as a high-velocity threat with confirmed wallet-draining capabilities. It is currently under active investigation and remains unresolved.

This domain leverages several red flags that heighten the risk profile. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 22, 2026, it resolves to IP 104.21.7.92 and is secured with a Let's Encrypt SSL certificate—common traits in short-lived malicious campaigns. Despite zero detections on VirusTotal (4/95 engines as of latest scan), the absence of detection does not indicate safety. Domain age under one month, combined with active hosting on a known cloud IP with minimal reputation, suggests a rapidly deployed campaign likely designed to evade detection through obscurity. The combination of a freshly registered domain, crypto-custodian impersonation, and absence of enterprise-grade monitoring points to elevated malicious intent.

To protect users and organizations, PhishDestroy recommends immediate network-level blocking of hextrustreward.com and 104.21.7.92 via firewall rules and DNS sinkholing. End users should treat any 'Hex Trust reward' communications involving wallet connections as suspicious—Hex Trust does not operate third-party reward domains. Additionally, enable wallet transaction simulation tools where available and revoke any wallet connections made to this domain. Report indicators to threat intelligence platforms and local CERTs to aid global takedown efforts. Users who have already connected wallets should disconnect immediately, rotate private keys (if self-custodied), and monitor for unauthorized transactions.