htxx[.]framer[.]ai

This domain, htxx.framer.ai, was set up to trick HTX users into handing over their login credentials. By mimicking the HTX brand and displaying a fake login page, it attempted to steal sensitive information. The site is now offline, but its purpose was clear: to phish unsuspecting users who thought they were accessing a legitimate HTX service.

PhishDestroy's analysis shows that the site was registered on January 6, 2018, through CSC Corporate Domains, Inc., and used a Let's Encrypt SSL certificate (E8) to appear legitimate. It resolved to IP 35.157.26.135. Despite having zero detections on VirusTotal (0/95), it was flagged by three security blocklists, and the seed b7dfad helped identify it as a threat. The page title was simply "Login," a common tactic for phishing pages.

If you visited htxx.framer.ai and entered any credentials, change your HTX password immediately and enable two-factor authentication. Monitor your accounts for any suspicious activity. Since the site is offline, the immediate risk is low, but always verify URLs before logging in and report any similar domains to HTX support.