hytaleget[.]com

This domain, hytaleget.com, is actively flagged as a high-risk phishing site targeting users with a fraudulent Hytale Multiplayer Beta Test Access page. Registered on February 21, 2026, through REGRU-RU, the domain resolves to the IP address 186.2.171.13 and is hosted behind DDoS-Guard infrastructure, a common pattern observed in phishing campaigns to obscure origin and mitigate takedown efforts. The site employs Let's Encrypt SSL certificates, Node.js, Vue.js, and Express, alongside HSTS, which may lend a superficial appearance of legitimacy but does not mitigate the underlying threat. Analysis indicates the domain has been included in 22 threat intelligence pulses, with detection by at least two security blocklists, including PhishDestroy and BLP-Malware. While only 3 of 95 security vendors flagged this domain on VirusTotal, this limited detection does not indicate safety; many phishing domains evade initial scans through rapid rotation or obfuscation techniques. The page title explicitly references Hytale, a gaming brand, suggesting an attempt to exploit interest in beta access programs. However, no further content analysis has been conducted to confirm the exact mechanics of the phishing attempt, such as credential harvesting or malware distribution. Defenders should treat this domain as active and malicious, prioritizing blocking at the DNS or network level. Given the use of DDoS-Guard and the Russian registrar, takedown efforts may require coordination with hosting providers and regional CERT teams. Monitoring for related domains registered through the same registrar or resolving to the same IP infrastructure is recommended to identify potential campaign expansion.