horfex[.]com

This domain, horfex.com, is flagged for credential theft targeting users through a fake verification portal. The site impersonates legitimate login pages to harvest usernames, passwords, and other sensitive account details. Visitors may encounter a German-language prompt, 'Nur einen Moment…', suggesting a localized or region-specific attack vector. The threat is designed to deceive users into entering credentials under the guise of a required verification process, which are then transmitted to attacker-controlled servers. Analysis indicates the domain was registered on April 19, 2025, through GMO Internet, Inc., and is currently offline. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare infrastructure, a common tactic to obscure hosting origins and evade detection. At the time of assessment, 2 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The use of Cloudflare Browser Insights and HTTP/3 further suggests an attempt to mimic legitimate sites while monitoring visitor interactions. If you visited horfex.com or entered credentials on the site, immediate action is required. First, change passwords for any accounts accessed or entered on the site, prioritizing email, financial, and work-related accounts. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor accounts for unauthorized activity, such as unfamiliar logins, transactions, or password reset attempts. If financial data was exposed, contact your bank or card issuer to report potential fraud. Run a full antivirus scan on the device used to visit the site to check for malware or keyloggers. Finally, report the domain to your organization’s security team or a national cybersecurity authority to aid in broader threat mitigation efforts.