hydration-2--preactjs[.]netlify[.]app

This domain is flagged as a credential theft operation impersonating the Preact JavaScript framework. Visitors are presented with a cloned version of the legitimate Preact documentation and development resources, designed to harvest login credentials, API keys, or other sensitive developer information. The site mimics the official Preact branding, including an identical page title: 'Preact | Preact: Fast 3kb React alternative with the same ES6 API. Components & Virtual DOM.' The deception extends to technical details, such as the use of a valid SSL certificate issued by DigiCert Inc, to appear legitimate to unsuspecting users.

Analysis indicates the domain is hosted on Netlify infrastructure and resolves to an IPv6 address (2a05:d014:58f:6200::259) within Amazon.com, Inc.'s AS16509 network, located in Germany. The domain is currently active and appears on one security blocklist. VirusTotal detection shows 1 out of 95 security vendors flagging this domain as malicious. The SSL certificate, while valid, does not mitigate the threat, as it is commonly used in phishing campaigns to bypass initial security warnings.

If you visited hydration-2--preactjs.netlify.app or entered any credentials, immediately revoke any exposed API keys, passwords, or session tokens. Scan the device used for access with updated security tools to detect potential malware or unauthorized access. Report the incident to your organization's security team and monitor accounts linked to the exposed credentials for suspicious activity. Avoid interacting with the domain or any related resources, as it remains active and poses an ongoing threat.