hydrex[.]one

This domain is flagged as an active credential harvesting phishing site targeting user authentication credentials. Analysis indicates the infrastructure is designed to mimic legitimate login portals, likely to capture sensitive account information such as usernames, passwords, and multi-factor authentication tokens. The site presents itself under the title 'Hydrex,' which may correspond to a spoofed brand or service interface, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain hydrex.one was registered on May 28, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious domain registrations. The site resolves to the IP address 104.21.10.115, hosted on AS13335 (Cloudflare, Inc.), a common tactic to obscure origin servers and evade detection. Despite its active status, the domain has not been flagged by VirusTotal, showing 0 detections out of 95 security engines. However, it appears on three independent security blocklists, indicating prior identification by threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Let's Encrypt, providing a false sense of security to visitors. Users who have visited hydrex.one or entered credentials on the site should immediately revoke any submitted information and change passwords for all potentially compromised accounts. Multi-factor authentication should be enabled where available, and affected credentials should be treated as exposed. System logs should be reviewed for signs of unauthorized access, and network traffic should be monitored for connections to 104.21.10.115 or related subdomains. Organizations are advised to block the domain and IP at the perimeter level to prevent further exposure. Given the domain's recent creation date and lack of widespread detection, heightened vigilance is recommended for any communications referencing 'Hydrex' or similar branding.