begin-htx-us[.]pages[.]dev

The domain begin-htx-us.pages.dev, hosted on Cloudflare Pages, is actively engaging in credential phishing by impersonating the brand HTX. This domain attempts to deceive users into providing their login credentials by presenting a fake login page titled 'Fast HTX Login – Access Your Crypto Wallet.' As of now, 3 out of 91 vendors on VirusTotal have flagged this domain as malicious, and it is also listed on one public blocklist, specifically PhishDestroy's.

The domain's creation and detection date coincide on June 9, 2026, indicating a rapid deployment of this phishing campaign. The hosting IP address is 188.114.96.3, and the SSL certificate is issued by Google Trust Services / WE1. The platform risk score for this domain is high, standing at 81 out of 100, suggesting a significant threat level.

PhishDestroy's early detection pipeline identifies threats like begin-htx-us.pages.dev in the critical window before widespread antivirus database updates. This proactive approach captures threats during their initial deployment phase, providing crucial early warnings to potential targets. The domain's presence on VirusTotal and blocklists underscores its malicious intent and the necessity for heightened awareness when interacting with any communication purporting to be from HTX.