hitfxmarket[.]net

The domain hitfxmarket.net is currently classified as a high‑risk generic phishing site and remains active as of the report date, July 27 2026. Registration data shows the domain was created on October 17 2023 through OwnRegistrar, Inc., indicating a relatively recent establishment that aligns with typical phishing campaign lifecycles. DNS resolution points to the IPv4 address 158.220.124.22, and the authoritative name servers are ns1.zunxoo.com and ns2.zunxoo.com, both of which are hosted by the same provider and have been observed in other malicious infrastructures. The domain appears on one known security blocklist and is specifically blocked by the PhishDestroy service, reinforcing the view that it is being actively used for malicious purposes.

VirusTotal analysis reports that three out of ninety‑one scanning engines have flagged the domain, providing independent vendor corroboration of its malicious nature. No additional public threat‑intel sources such as OTX or Safe Browsing entries are cited, so the broader ecosystem visibility is limited to the blocklist and vendor detections. The limited detection count suggests the campaign may be in an early deployment stage or employing techniques that evade many scanners, but the presence of any positive detections underlines a credible threat. Defenders should immediately block DNS resolution for hitfxmarket.net and the associated IP address 158.220.124.22 at perimeter and endpoint layers, and consider adding the domain to internal sinkhole lists.

Continuous monitoring of outbound connections to the identified nameservers ns1.zunxoo.com and ns2.zunxoo.com is advised, as changes to the DNS infrastructure could indicate campaign evolution. Because the site’s content has not been publicly analyzed, the exact phishing vectors, credential‑capture pages, or targeted brands remain unknown; threat hunters should prioritize traffic capture and sandbox analysis if any user interaction is observed.