baerax[.]com

PhishDestroy identifies baerax.com as an active credential theft domain currently under investigation, posing a significant risk to organizational and individual security. This domain is engineered to harvest user credentials under false pretenses, leveraging deceptive techniques to mimic trusted login portals. This domain was flagged due to its recent activity and suspicious infrastructure. baerax.com resolves to IP 104.21.9.91, a hosting address linked to low-trust SSL infrastructure via a Let's Encrypt certificate. Registered on March 31, 2026 through Realtime Register B.V., the domain remains undetected on VirusTotal with 6 out of 95 security engines flagging it. Despite its newness, it has already triggered alerts on two independent blocklists, including OISD and Hagezi. The absence of detections and the use of a reputable registrar highlight the stealth and evasive nature of this threat, which is actively masquerading as a legitimate service to capture credentials. Mitigating this threat requires immediate action. Organizations should block baerax.com and 104.21.9.91 at the network perimeter using DNS and firewall rules. Enable TLS inspection to detect any encrypted traffic heading to this domain. Additionally, users should be alerted via security awareness training about this domain and similar impersonation tactics. Implement browser-based blocklists and endpoint detection rules using IOCs derived from this analysis. Monitor authentication logs for anomalous login attempts from users who may have interacted with this domain during browsing sessions.