zyrex[.]id

This domain, zyrex.id, is flagged as a credential harvesting phishing site targeting users through a fabricated real-time location tracking service branded as ZyrexTrack. Analysis indicates the site impersonates legitimate tracking platforms to deceive victims into entering sensitive credentials, likely for account takeover or identity theft purposes. No specific drainer kit signatures were identified, but the generic phishing classification suggests broad targeting rather than a specialized payload. Infrastructure analysis reveals the domain was registered on June 14, 2026, through PT Dewabisnis Digital Indonesia, with resolution to IP address 94.100.26.12. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain, while it appears on a single security blocklist. The site employed a Let's Encrypt SSL certificate and utilized LiteSpeed server technology with HTTP/3 support. Google Safe Browsing status was not explicitly confirmed, but the domain's presence on one blocklist aligns with its elevated risk classification. The domain is currently offline, reducing immediate exposure risk. However, historical indicators suggest potential for re-emergence under similar infrastructure or registration patterns. Response actions should include monitoring for DNS reactivation, IP reassignment, or certificate reissuance tied to the same registrar or hosting provider. Organizations are advised to preemptively block the domain and IP in perimeter defenses, while end users should verify tracking services through official channels only. Remaining risk stems from possible credential reuse by threat actors if prior compromise occurred.