shtxtx[.]com

The domain shtxtx.com was registered on 21 February 2026 through Alibaba Cloud Computing (Beijing) Co., Ltd. It is currently active and is being used to impersonate the HTX brand, as indicated by the intelligence tag “brand_impersonation” and the page title “上海同心同行公益基金会”. The site returns an HTTP 302 redirect, suggesting it forwards visitors to a secondary location, a common technique in phishing campaigns.

Infrastructure analysis shows the domain resolves to the IP address 139.129.157.232, which is hosted in China and belongs to AS37963 Hangzhou Alibaba Advertising Co., Ltd. The authoritative name servers are dns13.hichina.com and dns14.hichina.com, both part of the same hosting provider. The TLS certificate presented is issued by DigiCert Inc under the “Encryption Everywhere DV TLS CA - G1” authority, indicating a legitimate certificate chain but offering no protection against malicious content.

Threat intelligence sources provide multiple corroborating signals. AlienVault OTX has listed the domain in 14 separate pulses, and VirusTotal reports that 11 of 95 security scanners flagged the domain as malicious. The domain appears on two public blocklists and is specifically flagged by Google Safe Browsing under the “SOCIAL_ENGINEERING” category. Additionally, Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment.

Defenders should treat shtxtx.com as a high‑severity threat. Immediate mitigation actions include adding the domain to DNS‑based blocklists, web proxy filters, and endpoint security deny lists. Continuous monitoring of traffic to the associated IP address and the two hichina.com name servers is advised, as they may be reused for other malicious campaigns. Organizations that rely on the HTX brand should educate users about unsolicited communications that reference the brand and encourage verification through official channels.