huofax[.]com

PhishDestroy identifies huofax.com as a recently activated phishing domain associated with a generic crypto drainer campaign. The domain was registered on March 23, 2026, and resolves to IP address 104.21.93.17. Threat actors are leveraging a Let's Encrypt SSL certificate issued through GMO Internet, Inc., to lend false legitimacy to the fraudulent site. The infrastructure is newly established and currently under active exploitation, with no detections on VirusTotal as of the latest scan. This domain presents several critical technical indicators: VirusTotal score stands at 1/95, indicating zero detection by security engines at the time of analysis. The domain is registered through GMO Internet, Inc., a known domain registrar, and resolves to IP 104.21.93.17. The domain was created on March 23, 2026, making it less than one week old at the time of this report. A Let's Encrypt SSL certificate is active, which may be used to deceive users into believing the site is secure. As of now, no entries are found in Google Safe Browsing (GSB) or major public blocklists. The campaign remains active and under investigation. PhishDestroy has flagged this domain with unique seed f0d1a2 and is tracking its propagation across social media and fraudulent advertisements. While the immediate risk is high due to the domain's recent creation and zero detections, users can mitigate exposure by verifying URLs on PhishDestroy before interaction. The threat level is currently classified as under_investigation, and further IOCs will be released as the investigation progresses. Remaining risk includes potential expansion to additional domains or IP addresses, increased detection evasion tactics, or integration into broader malware delivery networks.