governance-tydro[.]com

This domain, governance-tydro.com, is flagged as a high-risk generic phishing threat. It was created on April 29, 2026, and remains active as of July 12, 2026. The domain resolves to IP address 172.67.212.107, which is hosted by Cloudflare, Inc. in Canada. Registration was handled by PDR Ltd. d/b/a PublicDomainRegistry.com, and the nameservers are joyce.ns.cloudflare.com and tim.ns.cloudflare.com. The SSL certificate is issued by Let's Encrypt (E7), providing HTTPS encryption that can lend a false sense of legitimacy to visitors. Analysis indicates that the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports that 3 out of 95 security vendors flag this domain as malicious. Additionally, AlienVault OTX includes it in one threat intelligence pulse, and Gridinsoft assigns a trust score of 0 out of 100, indicating high suspicion. The HTTP status returned is 403, suggesting the server is configured to restrict access, possibly to avoid detection or analysis. What is uncertain is the specific brand or service targeted by this phishing campaign, as no brand information is available in the intelligence. The exact phishing kit or method used is also unknown. The infrastructure setup, with Cloudflare as a reverse proxy and Let's Encrypt for encryption, is common among phishing domains to evade basic scrutiny and appear legitimate. Defenders are advised to block access to this domain at network and email gateways. Users who may have interacted with the domain should change credentials for any accounts entered, especially if they involve cryptocurrency wallets or authentication services. Monitoring for related subdomains or variations is recommended, as the actors may deploy similar domains under the same registration pattern. Reporting the domain to the hosting provider and registrar can assist in takedown efforts.