fluids[.]one

Analysis of the domain fluids.one, observed on July 26, 2026, indicates a high‑risk phishing indicator. The domain is registered through Dynadot Inc, a widely used registrar, and is hosted on Cloudflare DNS as evidenced by the authoritative nameservers randy.ns.cloudflare.com and millie.ns.cloudflare.com. An HTTP 301 response is returned, suggesting the address redirects to another location, a common technique for concealing malicious payloads or credential‑harvesting pages. VirusTotal scans show that 2 of 91 security vendors have flagged the domain, providing early confirmation of malicious activity.

Independent blocklist aggregators have listed fluids.one on three separate security blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the phishing classification. The domain remains active, meaning the threat surface is currently live and capable of targeting victims. While the available data confirms phishing activity, details such as the final landing URL, SSL certificate attributes, or page content have not been disclosed, leaving the full attack vector unclear.

Defenders should continue to block the domain at network perimeter devices, update DNS filtering rules, and monitor for any traffic to the resolved Cloudflare IP ranges. Additional investigation, including sandboxed browsing and URL inspection, is recommended to capture the redirected content and to assess any credential‑stealing forms or malware drops that may be delivered after the 301 redirect. Organizations using phishing‑detection tools should ensure fluids.one is included in threat‑intel feeds to prevent user exposure, and incident response teams should be prepared to handle potential credential compromise reports linked to this domain.